@khanacademy/wonder-blocks-clickable - npm Package Compare versions

Comparing version 2.0.7 to 2.0.8

dist/es/index.js

@@ -766,7 +766,11 @@ import { Component, createElement } from 'react';
  * - false for hrefs staring with http://, https://, //.
- * - false for '#' and 'javascript:void(0);'
+ * - false for '#', 'javascript:...', 'mailto:...', 'tel:...', etc.
  * - true for all other values, e.g. /foo/bar
  */
 var isClientSideUrl = function isClientSideUrl(href) {
-  return !/^(https?:)?\/\//i.test(href) && !/^(#|javascript:void\(0\);?)$/.test(href);
+  if (typeof href !== "string") {
+    return false;
+  }
+
+  return !/^(https?:)?\/\//i.test(href) && !/^(#[\w-]*|[\w\-.]+:)/.test(href);
 };
@@ -773,0 +777,0 @@

dist/index.js

@@ -906,7 +906,11 @@ module.exports =
  * - false for hrefs staring with http://, https://, //.
- * - false for '#' and 'javascript:void(0);'
+ * - false for '#', 'javascript:...', 'mailto:...', 'tel:...', etc.
  * - true for all other values, e.g. /foo/bar
  */
 var isClientSideUrl = function isClientSideUrl(href) {
-  return !/^(https?:)?\/\//i.test(href) && !/^(#|javascript:void\(0\);?)$/.test(href);
+  if (typeof href !== "string") {
+    return false;
+  }
+
+  return !/^(https?:)?\/\//i.test(href) && !/^(#[\w-]*|[\w\-.]+:)/.test(href);
 };
@@ -913,0 +917,0 @@ // CONCATENATED MODULE: ./packages/wonder-blocks-clickable/src/util/get-clickable-behavior.js

package.json

 {
   "name": "@khanacademy/wonder-blocks-clickable",
-  "version": "2.0.7",
+  "version": "2.0.8",
   "design": "v1",
@@ -30,3 +30,3 @@ "description": "Clickable component for Wonder-Blocks.",
   },
-  "gitHead": "4aff5c505331e91477e1c8b454b9b2298004bd2d"
+  "gitHead": "599a5a63443ee89ced66297314d4aa765b210b26"
 }

src/util/__tests__/is-client-side-url.js.test.js

 // @flow
 import {isClientSideUrl} from "../is-client-side-url.js";
 
-describe("isExternalUrl", () => {
+describe("isClientSideUrl", () => {
     test("returns boolean based on the url", () => {
-        // external urls
+        // external URLs
         expect(
@@ -21,8 +21,16 @@ isClientSideUrl(
 
-        // fake hrefs
-        expect(isClientSideUrl("#")).toEqual(false);
+        // non-http(s) URLs
         expect(isClientSideUrl("javascript:void(0);")).toEqual(false);
         expect(isClientSideUrl("javascript:void(0)")).toEqual(false);
+        expect(isClientSideUrl("mailto:[e-mail]")).toEqual(false);
+        expect(isClientSideUrl("tel:[phone]")).toEqual(false);
+        expect(isClientSideUrl("tel:[phone]")).toEqual(false);
+        expect(isClientSideUrl("ms-help://kb12345.htm")).toEqual(false);
+        expect(isClientSideUrl("z39.50s://0.0.0.0")).toEqual(false);
 
-        // internal urls
+        // anchor-only HREFs
+        expect(isClientSideUrl("#")).toEqual(false);
+        expect(isClientSideUrl("#foo")).toEqual(false);
+
+        // internal URLs
         expect(isClientSideUrl("/foo//bar")).toEqual(true);
@@ -34,2 +42,9 @@ expect(isClientSideUrl("/coach/dashboard")).toEqual(true);
     });
+
+    test("invalid values for 'href' should return false", () => {
+        // $FlowIgnore: testing invalid input
+        expect(isClientSideUrl(null)).toEqual(false);
+        // $FlowIgnore: testing invalid input
+        expect(isClientSideUrl(undefined)).toEqual(false);
+    });
 });

src/util/is-client-side-url.js

@@ -5,10 +5,10 @@ // @flow
  * - false for hrefs staring with http://, https://, //.
- * - false for '#' and 'javascript:void(0);'
+ * - false for '#', 'javascript:...', 'mailto:...', 'tel:...', etc.
  * - true for all other values, e.g. /foo/bar
  */
 export const isClientSideUrl = (href: string): boolean => {
-    return (
-        !/^(https?:)?\/\//i.test(href) &&
-        !/^(#|javascript:void\(0\);?)$/.test(href)
-    );
+    if (typeof href !== "string") {
+        return false;
+    }
+    return !/^(https?:)?\/\//i.test(href) && !/^(#[\w-]*|[\w\-.]+:)/.test(href);
 };

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

204694

increased by0.45%

Lines of code

4829

increased by0.4%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes