slim-select - npm Package Compare versions

Comparing version 2.9.0 to 2.9.1

package.json

 {
   "name": "slim-select",
   "description": "Slim advanced select dropdown",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "author": "Brian Voelker <[e-mail]> (http://webiswhatido.com)",
@@ -56,17 +56,17 @@ "homepage": "https://slimselectjs.com",
     "@rollup/plugin-babel": "^6.0.4",
-    "@rollup/plugin-commonjs": "^26.0.1",
-    "@rollup/plugin-node-resolve": "^15.2.3",
-    "@rollup/plugin-replace": "^5.0.7",
+    "@rollup/plugin-commonjs": "^28.0.0",
+    "@rollup/plugin-node-resolve": "^15.3.0",
+    "@rollup/plugin-replace": "^6.0.1",
     "@rollup/plugin-terser": "^0.4.4",
-    "@rollup/plugin-typescript": "^11.1.6",
+    "@rollup/plugin-typescript": "^12.1.0",
     "@testing-library/jest-dom": "^6.5.0",
     "@testing-library/user-event": "^14.5.2",
     "@types/downloadjs": "^1.4.6",
-    "@types/jest": "^29.5.12",
-    "@typescript-eslint/eslint-plugin": "^8.5.0",
-    "@typescript-eslint/parser": "^8.5.0",
-    "@vitejs/plugin-vue": "^5.1.3",
+    "@types/jest": "^29.5.13",
+    "@typescript-eslint/eslint-plugin": "^8.8.1",
+    "@typescript-eslint/parser": "^8.8.1",
+    "@vitejs/plugin-vue": "^5.1.4",
     "clipboard": "^2.0.11",
     "downloadjs": "^1.4.7",
-    "eslint": "^9.10.0",
+    "eslint": "^9.12.0",
     "eslint-config-prettier": "^9.1.0",
@@ -81,14 +81,14 @@ "eslint-plugin-prettier": "^5.2.1",
     "rimraf": "^6.0.1",
-    "rollup": "^4.21.2",
+    "rollup": "^4.24.0",
     "rollup-plugin-peer-deps-external": "^2.2.4",
     "rollup-plugin-typescript2": "^0.36.0",
     "rollup-plugin-vue": "^6.0.0",
-    "sass": "^1.78.0",
+    "sass": "^1.79.5",
     "ts-jest": "^29.2.5",
     "tslib": "^2.7.0",
-    "typescript": "^5.6.2",
-    "vite": "^5.4.4",
-    "vite-plugin-dts": "^4.2.1",
-    "vue": "^3.5.4",
-    "vue-router": "^4.4.4",
+    "typescript": "^5.6.3",
+    "vite": "^5.4.8",
+    "vite-plugin-dts": "^4.2.4",
+    "vue": "^3.5.12",
+    "vue-router": "^4.4.5",
     "vue-tsc": "^2.1.6",
@@ -95,0 +95,0 @@ "vuex": "^4.0.2"

README.md

@@ -18,3 +18,3 @@ # Slim Select 2
 
-See [website](https://slimselectjs.com) for the full list of settings, methods and event callbacks
+See [website](https://slimselectjs.com) for the full list of [settings](https://slimselectjs.com/settings), [methods](https://slimselectjs.com/methods) and [event callbacks](https://slimselectjs.com/events)
 
@@ -156,2 +156,3 @@ ![](https://raw.githubusercontent.com/brianvoe/slim-select/master/slimselect.gif)
     maxValuesMessage: '{number} selected',
+    addableText: 'Press "Enter" to add {value}',
   },
@@ -172,3 +173,3 @@ })
     searchFilter: (option: Option, search: string) => boolean
-    addable: (value: string) => Promise<OptionOptional | string> | OptionOptional | string
+    addable: (value: string) => Promise<OptionOptional | string> | OptionOptional | string | Error
     beforeChange: (newVal: Option[], oldVal: Option[]) => boolean | void
@@ -175,0 +176,0 @@ afterChange: (newVal: Option[]) => void

src/slim-select/render.ts

@@ -75,3 +75,5 @@ import { debounce } from './helpers'
     // Add content to the content location settings
-    this.settings.contentLocation.appendChild(this.content.main)
+    if (this.settings.contentLocation) {
+      this.settings.contentLocation.appendChild(this.content.main)
+    }
   }
@@ -78,0 +80,0 @@

src/slim-select/select.ts

@@ -377,3 +377,3 @@ import { kebabCase } from './helpers'
     optionEl.value = info.value
-    optionEl.innerHTML = info.text
+    optionEl.textContent = info.text
     if (info.html !== '') {
@@ -380,0 +380,0 @@ optionEl.setAttribute('data-html', info.html)

src/slim-select/settings.test.ts

@@ -198,2 +198,17 @@ 'use strict'
 
+    test('malicious text is inserted with innerText', () => {
+      // decoded text: <img src=x onerror=alert(1)></img>
+      const str = '&#x3c;&#x69;&#x6d;&#x67;&#x20;&#x73;&#x72;&#x63;&#x3d;&#x78;&#x20;&#x6f;&#x6e;&#x65;&#x72;&#x72;&#x6f;&#x72;&#x3d;&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;&#x3e;&#x3c;&#x2f;&#x69;&#x6d;&#x67;&#x3e;'
+      // const str = 'opt'
+      const decode = (string: string|null) => {
+        if(string === null) return ''
+        const doc = new DOMParser().parseFromString(string, "text/html")
+        return doc.documentElement.textContent;
+      }
+      const option = new Option({ text: str })
+      const optionElement = select.createOption(option)
+      // expect(decode(optionElement.textContent)).toBe('opt')
+      expect(optionElement.textContent).toBe(str)
+    })
+
     test('disabled sets disabled property correctly', () => {
@@ -200,0 +215,0 @@ const option = new Option({ text: 'opt', disabled: true })

src/slim-select/settings.ts

@@ -27,3 +27,3 @@ import { generateID } from './helpers'
   public closeOnSelect: boolean
-  public contentLocation: HTMLElement
+  public contentLocation: HTMLElement | null
   public contentPosition: 'relative' | 'absolute'
@@ -30,0 +30,0 @@ public openPosition: 'auto' | 'up' | 'down'

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

749620

increased by0.15%

Lines of code

16082

increased by0.1%

Number of lines in readme file

182

increased by0.55%

No dependency changes