pull request - #109
Open
lisagorewitdecker wants to merge 23 commits into
Open
Conversation
Bumps the npm_and_yarn group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.13` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `4.1.10` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.13` | `1.1.18` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.1` | | [postcss](https://github.com/postcss/postcss) | `8.5.9` | `8.5.26` | | [valibot](https://github.com/open-circle/valibot) | `1.4.1` | `1.4.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.2` | `7.3.6` | | [ws](https://github.com/websockets/ws) | `8.20.0` | `8.21.3` | Bumps the npm_and_yarn group with 3 updates in the /sample-app directory: [dompurify](https://github.com/cure53/DOMPurify), [esbuild](https://github.com/evanw/esbuild) and [valibot](https://github.com/open-circle/valibot). Updates `dompurify` from 3.3.1 to 3.4.13 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.13) Updates `vitest` from 3.2.4 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `brace-expansion` from 1.1.13 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18) Updates `js-yaml` from 4.1.1 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.1) Updates `postcss` from 8.5.9 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.9...8.5.26) Updates `valibot` from 1.4.1 to 1.4.2 - [Release notes](https://github.com/open-circle/valibot/releases) - [Commits](open-circle/valibot@v1.4.1...v1.4.2) Updates `vite` from 7.3.2 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite) Updates `ws` from 8.20.0 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.0...8.21.3) Updates `dompurify` from 3.3.1 to 3.4.13 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.13) Updates `esbuild` from 0.25.12 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.25.12...v0.28.1) Updates `postcss` from 8.5.15 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.9...8.5.26) Updates `valibot` from 1.4.1 to 1.4.2 - [Release notes](https://github.com/open-circle/valibot/releases) - [Commits](open-circle/valibot@v1.4.1...v1.4.2) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: valibot dependency-version: 1.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: valibot dependency-version: 1.4.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
…npm_and_yarn-263a6c6a33 Bump the npm_and_yarn group across 2 directories with 9 updates
Updated dompurify dependency version requirement to allow 3.4.13 and above.
This workflow file sets up CodeQL analysis for the repository, specifying triggers for push and pull request events on the 'v7' branch, as well as a scheduled run. It includes a matrix for analyzing JavaScript and TypeScript with appropriate permissions and steps for initialization and analysis.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: lisagorewitdecker <50784106+lisagorewitdecker@users.noreply.github.com>
Add an overrides entry in sample-app/package.json to force all dompurify resolutions (including nested transitive deps) to ^3.4.13. This removes the stale nested node_modules/@cometchat/chat-uikit-react/ node_modules/dompurify@3.3.1 entry from the lockfile and replaces it with a single resolved version >=3.4.13. Co-authored-by: lisagorewitdecker <50784106+lisagorewitdecker@users.noreply.github.com>
Co-authored-by: lisagorewitdecker <50784106+lisagorewitdecker@users.noreply.github.com>
Update dompurify version requirement in package-lock.json
Add CodeQL analysis workflow for JavaScript and TypeScript
Bumps the npm_and_yarn group with 1 update in the / directory: [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node). Updates `@humanfs/node` from 0.16.7 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) --- updated-dependencies: - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
…npm_and_yarn-94863fc568
Bumps the npm_and_yarn group with 1 update in the / directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core). Updates `@babel/core` from 7.29.0 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `browserslist` from 4.28.2 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.2...4.28.9) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…npm_and_yarn-0a40f900e8 Bump the npm_and_yarn group across 1 directory with 2 updates
…-fixes Harden rich-text, external URL, and unread-count handling across the UI kit
There was a problem hiding this comment.
🟡 Changes recommended
The newly added npm overrides in the published package can unintentionally force transitive toolchain versions onto consumers and should be reconsidered/relocated before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR hardens multiple UI entry points against unsafe URLs / HTML injection and improves a few shared utilities (download handling, unread-count polling, and sound playback), with accompanying test updates and dependency/tooling adjustments.
Changes:
- Add URL scheme validation for extension URLs and downloads; tighten window-opening behavior.
- Sanitize/escape rich-text mention HTML and enforce safer anchor attributes in AI-sanitized HTML.
- Improve shared unread-count polling configurability and ensure SoundManager stops prior audio before starting a new one.
File summaries
| File | Description |
|---|---|
| src/utils/downloadWithProgress.ts | Blocks unsafe download URLs and handles non-OK fetch responses before falling back to window.open. |
| src/utils/tests/downloadWithProgress.spec.ts | Updates tests for new URL restrictions and non-OK response behavior. |
| src/resources/CometChatSoundManager/CometChatSoundManager.ts | Pauses any previously playing sound before starting a new sound. |
| src/resources/CometChatSoundManager/tests/CometChatSoundManager.spec.ts | Adds coverage for “pause previous audio” behavior. |
| src/plugins/shared/extractExtensionUrl.ts | Filters extension URLs to only allow http/https schemes. |
| src/plugins/shared/tests/extractExtensionUrl.spec.ts | Adds test for blocking unsafe URL schemes. |
| src/components/CometChatNotificationFeed/useNotificationUnreadCount.ts | Adds per-subscriber polling interval handling, SSR-safe window usage, and warning for unsupported category filtering. |
| src/components/CometChatNotificationFeed/tests/useNotificationUnreadCount.spec.tsx | Adds SSR/polling/warn tests for the hook. |
| src/components/CometChatMessageComposer/CometChatMessageComposerRoot.tsx | Escapes mention values, builds mention spans safely, and sanitizes edit-mode HTML before writing it into the editor. |
| src/components/CometChatMessageComposer/tests/CometChatMessageComposerRoot.spec.tsx | Refactors rich text editor mock and adds XSS-focused mention-label test. |
| src/components/CometChatGroupMembers/useCometChatGroupMembers.ts | Stabilizes logged-in UID dependency for real-time scope updates. |
| src/components/CometChatCollaborativeWhiteboardBubble/CometChatCollaborativeWhiteboardBubble.tsx | Opens collaborative URLs in a safer new-tab context (noopener/noreferrer). |
| src/components/CometChatCollaborativeWhiteboardBubble/tests/CometChatCollaborativeWhiteboardBubble.spec.tsx | Adds unsafe-URL disablement test. |
| src/components/CometChatCollaborativeDocumentBubble/CometChatCollaborativeDocumentBubble.tsx | Opens collaborative URLs in a safer new-tab context (noopener/noreferrer). |
| src/components/CometChatCollaborativeDocumentBubble/tests/CometChatCollaborativeDocumentBubble.spec.tsx | Adds unsafe-URL disablement test. |
| src/components/CometChatAIAssistantChat/CometChatAISanitize.ts | Enforces target/rel on sanitized anchors via a DOMPurify hook. |
| src/components/CometChatAIAssistantChat/tests/CometChatAISanitize.spec.ts | Updates expectation for rel to include noreferrer. |
| sample-app/package.json | Bumps DOMPurify/Vite tooling and adds overrides for DOMPurify. |
| sample-app/package-lock.json | Locks updated dependency graph for the sample app. |
| package.json | Bumps DOMPurify/Vitest and adds npm overrides in the published package. |
| .github/workflows/codeql.yml | Adds CodeQL workflow for JS/TS analysis. |
Review details
Files not reviewed (1)
- sample-app/package-lock.json: Generated file
- Files reviewed: 20/22 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+87
to
+91
| "overrides": { | ||
| "@babel/core": "7.29.7", | ||
| "browserslist": "4.28.9", | ||
| "esbuild": "0.28.2" | ||
| }, |
Comment on lines
+36
to
+43
| it('does not crash during server-side rendering', () => { | ||
| const SsrProbe = () => { | ||
| useNotificationUnreadCount(); | ||
| return React.createElement('div'); | ||
| }; | ||
|
|
||
| expect(() => renderToString(React.createElement(SsrProbe))).not.toThrow(); | ||
| }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.