fix: fix unsanitized untrusted input v2 #20092
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
...libs/product-configurator/rulebased/components/show-more/configurator-show-more.component.ts
Fixed
Show fixed
Hide fixed
projects/core/src/occ/adapters/product/converters/product-name-normalizer.ts
Fixed
Show fixed
Hide fixed
...libs/product-configurator/rulebased/components/show-more/configurator-show-more.component.ts
Fixed
Show fixed
Hide fixed
projects/core/src/occ/adapters/product/converters/product-name-normalizer.ts
Fixed
Show fixed
Hide fixed
...product-configurator/rulebased/components/show-more/configurator-show-more.component.spec.ts
Outdated
Show resolved
Hide resolved
...libs/product-configurator/rulebased/components/show-more/configurator-show-more.component.ts
Outdated
Show resolved
Hide resolved
projects/core/src/occ/adapters/product/converters/product-name-normalizer.ts
Outdated
Show resolved
Hide resolved
…re/CXSPA-8078-v2
...libs/product-configurator/rulebased/components/show-more/configurator-show-more.component.ts
Outdated
Show resolved
Hide resolved
projects/core/src/occ/adapters/product/converters/product-name-normalizer.ts
Outdated
Show resolved
Hide resolved
...libs/product-configurator/rulebased/components/show-more/configurator-show-more.component.ts
Fixed
Show fixed
Hide fixed
projects/core/src/occ/adapters/product/converters/product-name-normalizer.ts
Dismissed
Show dismissed
Hide dismissed
...libs/product-configurator/rulebased/components/show-more/configurator-show-more.component.ts
Dismissed
Show dismissed
Hide dismissed
Merge Checks Failed |
Merge Checks Failed |
| import { Product } from '../../../../model/product.model'; | ||
| import { Converter } from '../../../../util/converter.service'; | ||
| import { OccConfig } from '../../../config/occ-config'; | ||
| import { Occ } from '../../../occ-models/occ.models'; | ||
| import { SanitizeService } from '@spartacus/core'; |
There was a problem hiding this comment.
ProductNameNormalizer is a part of core library, and now you add dependency on '@spartacus/core', so it dependent from itself. Because of this CI failed, you can check it in github and reproduce also locally by running npm run build:core
| @Injectable({ | ||
| providedIn: 'root', | ||
| }) | ||
| export class SanitizeService { |
There was a problem hiding this comment.
Before I told only that if adding @angular/platform-browser as a peerDependency is a breaking change, to workaround we can create a wrapper in the core lib. But Kris confirmed that this peerDependency is safe, in this case we don't need a wrapper.
IMO creating new services files should solve some problem, if we don't have any problem with '@angular/platform-browser' as a peerDependency of product-configurator, there is no need to produce additional code.
| providedIn: 'root', | ||
| }) | ||
| export class SanitizeService { | ||
| constructor(private sanitizer: DomSanitizer) {} |
There was a problem hiding this comment.
As wrote above, I think we don't need this service, but just a reminder for the future - we should use inject instead of constructors for the DI. It will help to avoid breaking changes in feature, since any change in the constructor is breaking for customers
ticket: CXSPA-8078