web-manager 4.1.37 → 4.1.38

package/CHANGELOG.md

@@ -15,6 +15,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Security` in case of vulnerabilities.
 
 ---
+## [4.1.38] - 2026-04-08
+### Added
+- Added `sanitizeURL()` utility method that validates URLs against dangerous URI schemes (javascript:, data:, etc.), allowing only http: and https: protocols.
+
 ## [4.1.37] - 2026-04-05
 ### Added
 - Added `_resolveUsage()` to auth module that merges account usage data with plan limits from config, exposed as a top-level `usage` binding context.

package/CLAUDE.md

@@ -152,7 +152,8 @@ document.body.addEventListener('click', (e) => {
 ### Auth (`auth.js`)
 - **Class**: `Auth`
 - **Key Methods**: `listen(options, callback)`, `isAuthenticated()`, `getUser()`, `signInWithEmailAndPassword()`, `signOut()`, `getIdToken()`, `resolveSubscription(account?)`
-- **Bindings**: Updates `auth.user` and `auth.account` context
+- **Bindings**: Updates `auth` and `usage` context on auth settle
+- **Usage Resolution**: `_resolveUsage(state)` merges `account.usage` (Firestore) with plan limits from `config.payment.plans` to produce the `usage` bindings key (e.g., `{ credits: { monthly: 5, limit: 100 } }`)
 
 #### resolveSubscription(account?)
 Derives calculated subscription fields from raw account data. Returns only fields that require derivation logic — raw data (product.id, status, trial, cancellation) lives on `account.subscription` directly.
@@ -268,9 +269,14 @@ Current test coverage is minimal - focuses on configuration and storage.
 
 ### Modifying Configuration Defaults
 1. Edit `_processConfiguration()` in `src/index.js`
-2. Add to `defaults` object
+2. Add to `defaults` object (e.g., `payment: { processors: {}, plans: [] }`)
 3. Document in README.md Configuration section
 
+### Payment Configuration
+Payment config is set in `_config.yml` under `web_manager.payment` and includes:
+- `processors`: Stripe, PayPal, etc. (publishable keys)
+- `plans`: Array of `{ id, limits: { feature: N } }` used to resolve usage limits on the frontend
+
 ### Adding a Data Binding Action
 1. Edit `_executeAction()` in `src/modules/bindings.js`
 2. Add case for new action (e.g., `@class`)

package/dist/modules/utilities.js

@@ -81,6 +81,26 @@ class Utilities {
     return input;
   }
 
+  // Sanitize URL to prevent javascript:, data:, and other dangerous URI schemes
+  // Returns the original URL if safe, or '' if rejected
+  sanitizeURL(url) {
+    if (!url || typeof url !== 'string') {
+      return '';
+    }
+
+    try {
+      const parsed = new URL(url, window.location.origin);
+
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return '';
+      }
+
+      return url;
+    } catch (e) {
+      return '';
+    }
+  }
+
   // Show notification
   showNotification(message, options = {}) {
     // Handle different input types

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web-manager",
-  "version": "4.1.37",
+  "version": "4.1.38",
   "description": "Easily access important variables such as the query string, current domain, and current page in a single object.",
   "main": "dist/index.js",
   "module": "src/index.js",