MWPW-159191: MAS Freyja support #3209
Conversation
This reverts commit a3a8824.
…MWPW-157451 # Conflicts: # libs/deps/mas/mas.js # libs/deps/mas/merch-card.js # libs/features/mas/mas/dist/mas.js
to support all cta styles organise code and code coverage Update tests
|
Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
Commits
|
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit
eslint
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
There was a problem hiding this comment.
File ignored because of a matching ignore pattern. Use "--no-ignore" to override.
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## ccd #3209 +/- ##
==========================================
- Coverage 96.37% 96.31% -0.07%
==========================================
Files 245 243 -2
Lines 56716 56815 +99
==========================================
+ Hits 54661 54720 +59
- Misses 2055 2095 +40 ☔ View full report in Codecov by Sentry. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| switch (variant) { | ||
| case 'ccd-slice': | ||
| if (backgroundImageConfig) { | ||
| merchCard.append( | ||
| createTag( | ||
| backgroundImageConfig.tag, | ||
| { slot: backgroundImageConfig.slot }, | ||
| `<img loading="lazy" src="${fragment.backgroundImage}" />`, | ||
| `<img loading="lazy" src="${fields.backgroundImage}" />`, |
Check warning
Code scanning / CodeQL
Unsafe HTML constructed from library input Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 3 hours ago
To fix the problem, we need to ensure that the fields.backgroundImage value is sanitized before being inserted into the HTML. This can be done by using a library like DOMPurify to sanitize the input or by creating a safe DOM element and setting its attributes directly.
The best way to fix this without changing existing functionality is to use the DOMPurify library to sanitize the fields.backgroundImage value before inserting it into the HTML. This ensures that any potentially malicious content is removed.
| @@ -1,2 +1,3 @@ | ||
| import { createTag } from './utils.js'; | ||
| import DOMPurify from 'dompurify'; | ||
|
|
||
| @@ -93,3 +94,3 @@ | ||
| { slot: backgroundImageConfig.slot }, | ||
| `<img loading="lazy" src="${fields.backgroundImage}" />`, | ||
| `<img loading="lazy" src="${DOMPurify.sanitize(fields.backgroundImage)}" />`, | ||
| ), |
| @@ -20,2 +20,3 @@ | ||
| "dependencies": { | ||
| "dompurify": "^3.2.0" | ||
| }, |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.0 | None |
Resolves: MWPW-159191
In this PR, I also removed the ccd-action variant that was merged for the initial MAS POC.
Depends on: #3135
Test URLs: