@contentful/rich-text-html-renderer - npm Package Compare versions

Comparing version 15.1.0 to 15.2.0

dist/lib/rich-text-html-renderer/src/__test__/index.test.js

@@ -6,2 +6,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+var cloneDeep_1 = __importDefault(require("lodash/cloneDeep"));
 var rich_text_types_1 = require("@contentful/rich-text-types");
@@ -190,2 +191,14 @@ var index_1 = require("../index");
     });
+    it('renders hyperlink without allowing html injection via `data.uri`', function () {
+        var document = cloneDeep_1.default(documents_1.hyperlinkDoc);
+        document.content[0].content[1].data.uri = '">no html injection!<a href="';
+        var expected = '<p>Some text <a href="&quot;>no html injection!<a href=&quot;">link</a> text.</p>';
+        expect(index_1.documentToHtmlString(document)).toEqual(expected);
+    });
+    it('renders hyperlink without invalid non-string `data.uri` values', function () {
+        var document = cloneDeep_1.default(documents_1.hyperlinkDoc);
+        document.content[0].content[1].data.uri = 42;
+        var expected = '<p>Some text <a href="">link</a> text.</p>';
+        expect(index_1.documentToHtmlString(document)).toEqual(expected);
+    });
     it("renders asset hyperlink", function () {
@@ -192,0 +205,0 @@ var asset = {

dist/lib/rich-text-html-renderer/src/index.js

@@ -20,2 +20,3 @@ "use strict";
 var rich_text_types_1 = require("@contentful/rich-text-types");
+var attributeValue = function (value) { return "\"" + value.replace(/"/g, '"') + "\""; };
 var defaultNodeRenderers = (_a = {},
@@ -41,3 +42,6 @@ _a[rich_text_types_1.BLOCKS.PARAGRAPH] = function (node, next) { return "<p>" + next(node.content) + "</p>"; },
     _a[rich_text_types_1.INLINES.EMBEDDED_ENTRY] = function (node) { return defaultInline(rich_text_types_1.INLINES.EMBEDDED_ENTRY, node); },
-    _a[rich_text_types_1.INLINES.HYPERLINK] = function (node, next) { return "<a href=\"" + node.data.uri + "\">" + next(node.content) + "</a>"; },
+    _a[rich_text_types_1.INLINES.HYPERLINK] = function (node, next) {
+        var href = typeof node.data.uri === 'string' ? node.data.uri : '';
+        return "<a href=" + attributeValue(href) + ">" + next(node.content) + "</a>";
+    },
     _a);
@@ -51,3 +55,3 @@ var defaultMarkRenderers = (_b = {},
 var defaultInline = function (type, node) {
-    return "<span>type: " + type + " id: " + node.data.target.sys.id + "</span>";
+    return "<span>type: " + escape_html_1.default(type) + " id: " + escape_html_1.default(node.data.target.sys.id) + "</span>";
 };
@@ -54,0 +58,0 @@ /**

dist/rich-text-html-renderer.es5.js

@@ -305,3 +305,3 @@ 'use strict';
 })('versions', []).push({
-  version: '3.16.0',
+  version: '3.16.1',
   mode: 'global',
@@ -1127,2 +1127,3 @@ copyright: '© 2021 Denis Pushkarev (zloirock.ru)'
 var _a, _b;
+var attributeValue = function (value) { return "\"" + value.replace(/"/g, '"') + "\""; };
 var defaultNodeRenderers = (_a = {},
@@ -1148,3 +1149,6 @@ _a[richTextTypes_es5_1.PARAGRAPH] = function (node, next) { return "<p>" + next(node.content) + "</p>"; },
     _a[richTextTypes_es5_4.EMBEDDED_ENTRY] = function (node) { return defaultInline(richTextTypes_es5_4.EMBEDDED_ENTRY, node); },
-    _a[richTextTypes_es5_4.HYPERLINK] = function (node, next) { return "<a href=\"" + node.data.uri + "\">" + next(node.content) + "</a>"; },
+    _a[richTextTypes_es5_4.HYPERLINK] = function (node, next) {
+        var href = typeof node.data.uri === 'string' ? node.data.uri : '';
+        return "<a href=" + attributeValue(href) + ">" + next(node.content) + "</a>";
+    },
     _a);
@@ -1158,3 +1162,3 @@ var defaultMarkRenderers = (_b = {},
 var defaultInline = function (type, node) {
-    return "<span>type: " + type + " id: " + node.data.target.sys.id + "</span>";
+    return "<span>type: " + escapeHtml_1(type) + " id: " + escapeHtml_1(node.data.target.sys.id) + "</span>";
 };
@@ -1161,0 +1165,0 @@ /**

package.json

 {
   "name": "@contentful/rich-text-html-renderer",
-  "version": "15.1.0",
+  "version": "15.2.0",
   "main": "dist/rich-text-html-renderer.es5.js",
@@ -32,3 +32,5 @@ "typings": "dist/types/index.d.ts",
     "@types/escape-html": "0.0.20",
+    "@types/lodash.clonedeep": "^4.5.6",
     "jest": "^24.7.1",
+    "lodash.clonedeep": "^4.5.0",
     "rimraf": "^2.6.3",
@@ -45,3 +47,3 @@ "rollup": "^1.11.0",
   },
-  "gitHead": "9cbd4f6888ee8c94f970923afdfadd91d7f049cb"
+  "gitHead": "09a15e9635f8b5f2dba0f10648e3ccdcb03d87e5"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

225667

increased by1.21%

Lines of code

2752

increased by0.77%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Dev dependency count

14

increased by16.67%

No dependency changes