treege 3.0.0-beta.19 → 3.0.0-beta.20

package/dist/editor.js

@@ -1,5 +1,5 @@
-import { T as o } from "./TreegeEditor-BP0R2rMo.js";
-import { T as m, u as s } from "./ThemeContext-CQoWKClD.js";
+import { T as o } from "./TreegeEditor-LKN_xeXZ.js";
+import { T as m, u as s } from "./ThemeContext-BIT4DHqC.js";
 export {
   m as ThemeProvider,
   o as TreegeEditor,

package/dist/main.js

@@ -1,6 +1,6 @@
-import { T as t } from "./TreegeEditor-BP0R2rMo.js";
-import { T as u, d as l, g as r, b as o, c as i, i as n, a as d, u as f } from "./ThemeContext-CQoWKClD.js";
-import { c as T, d as D, e as I, f as m, g, h as c, D as F, i as R, j as x, k as N, l as S, m as b, n as v, o as h, p as w, q as C, r as z, s as A, v as H, w as k, T as y, b as E, L as G, M as P, J as U, K as V, t as j, x as q, y as B, z as J, A as K, C as L, F as M, G as O, I as Q, E as W, H as X, B as Y, u as Z, a as _ } from "./TreegeRenderer-ClfGb4Mq.js";
+import { T as t } from "./TreegeEditor-LKN_xeXZ.js";
+import { T as u, d as l, g as r, b as i, c as n, i as o, a as d, u as p } from "./ThemeContext-BIT4DHqC.js";
+import { c as T, d as D, e as I, f as m, g, h as c, D as F, i as R, j as N, k as x, l as S, m as b, n as v, o as h, p as w, q as z, r as C, s as H, v as A, w as k, T as y, b as E, L as G, M as P, J as U, K as V, t as j, x as q, y as B, z as J, A as K, C as L, F as M, G as O, I as Q, E as W, H as X, N as Y, O as Z, B as _, u as $, a as ee } from "./TreegeRenderer--ZEq_w_0.js";
 export {
   T as DefaultAddressInput,
   D as DefaultAutocompleteInput,
@@ -10,17 +10,17 @@ export {
   c as DefaultFileInput,
   F as DefaultGroup,
   R as DefaultHiddenInput,
-  x as DefaultHttpInput,
-  N as DefaultNumberInput,
+  N as DefaultHttpInput,
+  x as DefaultNumberInput,
   S as DefaultPasswordInput,
   b as DefaultRadioInput,
   v as DefaultSelectInput,
   h as DefaultSwitchInput,
   w as DefaultTextAreaInput,
-  C as DefaultTextInput,
-  z as DefaultTimeInput,
-  A as DefaultTimeRangeInput,
-  H as Divider,
+  z as DefaultTextInput,
+  C as DefaultTimeInput,
+  H as DefaultTimeRangeInput,
+  A as Divider,
   u as ThemeProvider,
   k as Title,
   y as TreegeConfigProvider,
@@ -41,14 +41,16 @@ export {
   l as getStaticTranslations,
   r as getTranslatedText,
   Q as isFieldEmpty,
-  o as isFlowNode,
-  i as isGroupNode,
-  n as isInputNode,
+  i as isFlowNode,
+  n as isGroupNode,
+  o as isInputNode,
   W as isStartNode,
   d as isUINode,
   X as mergeFlows,
-  Y as serializableToFile,
-  f as useTheme,
-  Z as useTreegeConfig,
-  _ as useTreegeRenderer
+  Y as sanitize,
+  Z as sanitizeHttpResponse,
+  _ as serializableToFile,
+  p as useTheme,
+  $ as useTreegeConfig,
+  ee as useTreegeRenderer
 };

package/dist/renderer/features/TreegeRenderer/useTreegeRenderer.d.ts

@@ -39,7 +39,7 @@ export declare const useTreegeRenderer: (flows: Flow | Flow[] | null | undefined
     setFieldValue: (fieldName: string, value: unknown) => void;
     setFormErrors: import('react').Dispatch<import('react').SetStateAction<Record<string, string>>>;
     setMultipleFieldValues: (updates: FormValues) => void;
-    t: (key?: import('../../../main').Translatable | import('../../../main').TranslationKey | string) => string;
+    t: (key?: import('../../../main').Translatable | string) => string;
     validateForm: (customValidate?: (values: FormValues, visibleNodesList: Node<TreegeNodeData>[]) => Record<string, string>) => {
         errors: {
             [x: string]: string;

package/dist/renderer/features/TreegeRenderer/web/TreegeRenderer.d.ts

@@ -1,3 +1,3 @@
 import { TreegeRendererProps } from '../../../types/renderer';
-declare const TreegeRenderer: ({ components, flows, googleApiKey, initialValues, language, onChange, onSubmit, theme, validate, validationMode, }: TreegeRendererProps) => import("react/jsx-runtime").JSX.Element;
+declare const TreegeRenderer: ({ components, flows, googleApiKey, language, onChange, onSubmit, theme, validate, validationMode, initialValues, }: TreegeRendererProps) => import("react/jsx-runtime").JSX.Element;
 export default TreegeRenderer;

package/dist/renderer/hooks/useTranslate.d.ts

@@ -1,10 +1,12 @@
+import { Translatable } from '../../shared/types/translate';
 /**
  * Hook for translating text in the renderer with context-aware language preference.
  *
  * This hook uses the language from TreegeRendererContext (or explicit override) and delegates to the shared useTranslate hook.
+ * All translations are automatically sanitized to prevent XSS attacks.
  *
  * @param language - Optional language override. If not provided, uses language from context.
- * @returns A function that translates either a translation key or a Translatable object
+ * @returns A function that translates either a translation key or a Translatable object (with XSS protection)
  *
  * @example
  * // Static translation (from translation files)
@@ -12,13 +14,13 @@
  * const errorMsg = t("validation.required"); // "This field is required"
  *
  * @example
- * // Dynamic translation (from node data)
+ * // Dynamic translation (from node data) - automatically sanitized
  * const t = useTranslate();
- * const label = t(node.data.label); // Translates user-defined content
+ * const label = t(node.data.label); // Translates and sanitizes user-defined content
  *
  * @example
  * // With explicit language
  * const t = useTranslate("fr");
  * const errorMsg = t("validation.required"); // "Ce champ est requis"
  */
-export declare const useTranslate: (language?: string) => (key?: import('../../main').Translatable | import('../../main').TranslationKey | string) => string;
+export declare const useTranslate: (language?: string) => (key?: Translatable | string) => string;

package/dist/renderer/index.d.ts

@@ -13,5 +13,6 @@ export * from './utils/conditions';
 export * from './utils/file';
 export * from './utils/flow';
 export * from './utils/form';
+export * from './utils/sanitize';
 export { ThemeProvider, useTheme } from '../shared/context/ThemeContext';
 export { getTranslatedText } from '../shared/utils/translations';

package/dist/renderer/utils/sanitize.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Configuration for DOMPurify sanitization
+ */
+interface SanitizeOptions {
+    /**
+     * Allow only plain text (strip all HTML tags)
+     * @default true
+     */
+    plainTextOnly?: boolean;
+    /**
+     * Custom allowed tags (when plainTextOnly is false)
+     */
+    allowedTags?: string[];
+    /**
+     * Custom allowed attributes (when plainTextOnly is false)
+     */
+    allowedAttributes?: string[];
+}
+/**
+ * Sanitizes user input to prevent XSS attacks
+ *
+ * This utility wraps DOMPurify and provides secure defaults for the treege library.
+ * It should be used on all user-provided content before rendering, especially:
+ * - Labels from node data
+ * - Helper text
+ * - Placeholder text
+ * - Any content from HTTP responses
+ *
+ * @param input - The string to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized string safe for rendering
+ *
+ * @example
+ * // Plain text only (default behavior)
+ * sanitize('<script>alert("xss")</script>Hello')
+ * // => 'Hello'
+ *
+ * @example
+ * // Allow safe HTML tags
+ * sanitize('<b>Bold text</b><script>alert("xss")</script>', { plainTextOnly: false })
+ * // => '<b>Bold text</b>'
+ *
+ * @example
+ * // Custom allowed tags
+ * sanitize('<a href="http://example.com">Link</a>', {
+ *   plainTextOnly: false,
+ *   allowedTags: ['a'],
+ *   allowedAttributes: ['href']
+ * })
+ * // => '<a href="http://example.com">Link</a>'
+ */
+export declare const sanitize: (input: string | undefined | null, options?: SanitizeOptions) => string;
+/**
+ * Sanitizes data from HTTP responses
+ *
+ * This function recursively sanitizes all string values in an object or array.
+ * Useful for cleaning data received from external APIs before displaying it.
+ *
+ * Protection against:
+ * - Circular references: Uses WeakSet to detect and handle circular objects
+ * - Deep nesting attacks: Limits recursion depth to prevent DoS
+ * - XSS attacks: Sanitizes all string values
+ *
+ * @param data - The data to sanitize (can be any type)
+ * @param options - Sanitization options
+ * @param depth - Current recursion depth (internal use)
+ * @param seen - WeakSet to track visited objects (internal use)
+ * @returns Sanitized data with same structure
+ *
+ * @example
+ * sanitizeHttpResponse({
+ *   name: 'John <script>xss</script>',
+ *   nested: { title: 'Hello <b>world</b>' }
+ * })
+ * // => { name: 'John ', nested: { title: 'Hello <b>world</b>' } }
+ *
+ * @example
+ * // Handles circular references gracefully
+ * const obj = { name: 'Test' };
+ * obj.self = obj;
+ * sanitizeHttpResponse(obj)
+ * // => { name: 'Test', self: { name: 'Test' } } // circular ref broken
+ */
+export declare const sanitizeHttpResponse: (data: unknown, options?: SanitizeOptions, depth?: number, seen?: WeakSet<object>) => unknown;
+export {};

package/dist/renderer.js

@@ -1,12 +1,12 @@
-import { c as t, d as s, e as u, f as l, g as r, h as n, D as i, i as o, j as f, k as p, l as d, m as D, n as I, o as T, p as m, q as g, r as c, s as F, v as R, w as v, T as x, b as S, L as b, M as h, J as C, K as w, t as z, x as A, y as H, z as N, A as k, C as y, F as P, G as E, I as G, E as U, H as V, B as j, u as q, a as B } from "./TreegeRenderer-ClfGb4Mq.js";
-import { T as K, g as L, u as M } from "./ThemeContext-CQoWKClD.js";
+import { c as t, d as s, e as u, f as l, g as n, h as r, D as i, i as o, j as f, k as p, l as d, m as D, n as I, o as T, p as m, q as g, r as c, s as F, v as R, w as v, T as x, b as S, L as b, M as h, J as z, K as C, t as w, x as H, y as N, z as A, A as k, C as y, F as P, G as E, I as G, E as U, H as V, N as j, O as q, B, u as J, a as K } from "./TreegeRenderer--ZEq_w_0.js";
+import { T as M, g as O, u as Q } from "./ThemeContext-BIT4DHqC.js";
 export {
   t as DefaultAddressInput,
   s as DefaultAutocompleteInput,
   u as DefaultCheckboxInput,
   l as DefaultDateInput,
-  r as DefaultDateRangeInput,
-  n as DefaultFileInput,
+  n as DefaultDateRangeInput,
+  r as DefaultFileInput,
   i as DefaultGroup,
   o as DefaultHiddenInput,
   f as DefaultHttpInput,
@@ -20,28 +20,30 @@ export {
   c as DefaultTimeInput,
   F as DefaultTimeRangeInput,
   R as Divider,
-  K as ThemeProvider,
+  M as ThemeProvider,
   v as Title,
   x as TreegeConfigProvider,
   S as TreegeRenderer,
   b as applyReferenceTransformation,
   h as calculateReferenceFieldUpdates,
-  C as checkFormFieldHasValue,
-  w as convertFormValuesToNamedFormat,
-  z as defaultInputRenderers,
-  A as defaultUI,
-  H as evaluateCondition,
-  N as evaluateConditions,
+  z as checkFormFieldHasValue,
+  C as convertFormValuesToNamedFormat,
+  w as defaultInputRenderers,
+  H as defaultUI,
+  N as evaluateCondition,
+  A as evaluateConditions,
   k as fileToSerializable,
   y as filesToSerializable,
   P as findStartNode,
   E as getFlowRenderState,
-  L as getTranslatedText,
+  O as getTranslatedText,
   G as isFieldEmpty,
   U as isStartNode,
   V as mergeFlows,
-  j as serializableToFile,
-  M as useTheme,
-  q as useTreegeConfig,
-  B as useTreegeRenderer
+  j as sanitize,
+  q as sanitizeHttpResponse,
+  B as serializableToFile,
+  Q as useTheme,
+  J as useTreegeConfig,
+  K as useTreegeRenderer
 };

package/dist/shared/locales/ar.json.d.ts

@@ -264,11 +264,11 @@ declare const _default: {
       "selectOption": "اختر خياراً"
     },
     "defaultHttpInput": {
-      "fetchFailed": "فشل في جلب البيانات",
-      "httpError": "HTTP {status}: {statusText}",
+      "fetchFailed": "فشل في جلب البيانات. يرجى التحقق من اتصالك بالشبكة.",
+      "httpError": "خطأ HTTP {status}: {statusText}",
       "noDataAvailable": "لا توجد بيانات متاحة. قم بتكوين \"جلب عند التحميل\" أو أضف معامل بحث.",
       "noResults": "لم يتم العثور على نتائج.",
-      "noUrlConfigured": "لم يتم تكوين رابط",
+      "noUrlConfigured": "لم يتم تكوين رابط. يرجى إضافة عنوان URL في إعدادات HTTP.",
       "retry": "إعادة المحاولة",
       "search": "بحث...",
       "searching": "جاري البحث...",

package/dist/shared/locales/de.json.d.ts

@@ -264,11 +264,11 @@ declare const _default: {
       "selectOption": "Option auswählen"
     },
     "defaultHttpInput": {
-      "fetchFailed": "Fehler beim Abrufen der Daten",
-      "httpError": "HTTP {status}: {statusText}",
+      "fetchFailed": "Fehler beim Abrufen der Daten. Bitte überprüfen Sie Ihre Netzwerkverbindung.",
+      "httpError": "HTTP-Fehler {status}: {statusText}",
       "noDataAvailable": "Keine Daten verfügbar. Konfigurieren Sie \"Beim Laden abrufen\" oder fügen Sie einen Suchparameter hinzu.",
       "noResults": "Keine Ergebnisse gefunden.",
-      "noUrlConfigured": "Keine URL konfiguriert",
+      "noUrlConfigured": "Keine URL konfiguriert. Bitte fügen Sie eine URL in der HTTP-Konfiguration hinzu.",
       "retry": "Erneut versuchen",
       "search": "Suchen...",
       "searching": "Suche läuft...",

package/dist/shared/locales/en.json.d.ts

@@ -264,11 +264,11 @@ declare const _default: {
       "selectOption": "Select an option"
     },
     "defaultHttpInput": {
-      "fetchFailed": "Failed to fetch data",
-      "httpError": "HTTP {status}: {statusText}",
+      "fetchFailed": "Failed to fetch data. Please check your network connection.",
+      "httpError": "HTTP Error {status}: {statusText}",
       "noDataAvailable": "No data available. Configure \"Fetch on mount\" or add a search parameter.",
       "noResults": "No results found.",
-      "noUrlConfigured": "No URL configured",
+      "noUrlConfigured": "No URL configured. Please add a URL in the HTTP configuration.",
       "retry": "Retry",
       "search": "Search...",
       "searching": "Search...",

package/dist/shared/locales/es.json.d.ts

@@ -264,11 +264,11 @@ declare const _default: {
       "selectOption": "Seleccionar una opción"
     },
     "defaultHttpInput": {
-      "fetchFailed": "Error al obtener los datos",
-      "httpError": "HTTP {status}: {statusText}",
+      "fetchFailed": "Error al obtener los datos. Por favor, verifique su conexión de red.",
+      "httpError": "Error HTTP {status}: {statusText}",
       "noDataAvailable": "No hay datos disponibles. Configure \"Cargar al montar\" o agregue un parámetro de búsqueda.",
       "noResults": "No se encontraron resultados.",
-      "noUrlConfigured": "No hay URL configurada",
+      "noUrlConfigured": "No hay URL configurada. Por favor, agregue una URL en la configuración HTTP.",
       "retry": "Reintentar",
       "search": "Buscar...",
       "searching": "Buscando...",

package/dist/shared/locales/fr.json.d.ts

@@ -264,11 +264,11 @@ declare const _default: {
       "selectOption": "Sélectionner une option"
     },
     "defaultHttpInput": {
-      "fetchFailed": "Échec de la récupération des données",
-      "httpError": "HTTP {status} : {statusText}",
+      "fetchFailed": "Échec de la récupération des données. Veuillez vérifier votre connexion réseau.",
+      "httpError": "Erreur HTTP {status} : {statusText}",
       "noDataAvailable": "Aucune donnée disponible. Configurez \"Charger au montage\" ou ajoutez un paramètre de recherche.",
       "noResults": "Aucun résultat trouvé.",
-      "noUrlConfigured": "Aucune URL configurée",
+      "noUrlConfigured": "Aucune URL configurée. Veuillez ajouter une URL dans la configuration HTTP.",
       "retry": "Réessayer",
       "search": "Recherche...",
       "searching": "Recherche...",

package/dist/shared/locales/it.json.d.ts

@@ -264,11 +264,11 @@ declare const _default: {
       "selectOption": "Seleziona un'opzione"
     },
     "defaultHttpInput": {
-      "fetchFailed": "Impossibile recuperare i dati",
-      "httpError": "HTTP {status}: {statusText}",
+      "fetchFailed": "Impossibile recuperare i dati. Controlla la tua connessione di rete.",
+      "httpError": "Errore HTTP {status}: {statusText}",
       "noDataAvailable": "Nessun dato disponibile. Configura \"Carica al montaggio\" o aggiungi un parametro di ricerca.",
       "noResults": "Nessun risultato trovato.",
-      "noUrlConfigured": "Nessun URL configurato",
+      "noUrlConfigured": "Nessun URL configurato. Aggiungi un URL nella configurazione HTTP.",
       "retry": "Riprova",
       "search": "Cerca...",
       "searching": "Ricerca in corso...",

package/dist/shared/locales/pt.json.d.ts

@@ -264,11 +264,11 @@ declare const _default: {
       "selectOption": "Selecione uma opção"
     },
     "defaultHttpInput": {
-      "fetchFailed": "Falha ao buscar dados",
-      "httpError": "HTTP {status}: {statusText}",
+      "fetchFailed": "Falha ao buscar dados. Por favor, verifique sua conexão de rede.",
+      "httpError": "Erro HTTP {status}: {statusText}",
       "noDataAvailable": "Nenhum dado disponível. Configure \"Buscar na montagem\" ou adicione um parâmetro de pesquisa.",
       "noResults": "Nenhum resultado encontrado.",
-      "noUrlConfigured": "Nenhuma URL configurada",
+      "noUrlConfigured": "Nenhuma URL configurada. Por favor, adicione uma URL na configuração HTTP.",
       "retry": "Tentar novamente",
       "search": "Pesquisar...",
       "searching": "Pesquisando...",

package/package.json

@@ -2,7 +2,7 @@
   "name": "treege",
   "description": "Powerful form generator",
   "license": "ISC",
-  "version": "3.0.0-beta.19",
+  "version": "3.0.0-beta.20",
   "type": "module",
   "types": "./dist/main.d.ts",
   "module": "./dist/main.js",
@@ -65,6 +65,7 @@
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "date-fns": "^4.1.0",
+    "dompurify": "^3.3.0",
     "lucide-react": "^0.544.0",
     "nanoid": "^5.1.6",
     "next-themes": "^0.4.6",
@@ -81,6 +82,7 @@
     "@testing-library/react": "^16.3.0",
     "@testing-library/react-hooks": "^8.0.1",
     "@tracktor/biome-config-react": "^1.4.0",
+    "@types/dompurify": "^3.2.0",
     "@types/google.maps": "^3.58.1",
     "@types/node": "^24.5.2",
     "@types/react": "^19.1.0",