Repository navigation
feat(DriverJs): update DriverJs to v1.11.0 - #1283
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reviewer's GuideConfigurationBump the DriverJs component package version to 11.0.1-beta05.
Lock files and vendored codeUpdate the bundled Driver.js JavaScript and CSS assets to v1.11.0.
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![bb-auto[bot]](https://avatars.githubusercontent.com/in/287253?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 security issues
Security issues:
- User controlled data in methods like
innerHTML,outerHTMLordocument.writeis an anti-pattern that can lead to XSS vulnerabilities (link) - User controlled data in a
e.innerHTMLis an anti-pattern that can lead to XSS vulnerabilities (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/components/BootstrapBlazor.DriverJs/wwwroot/driver.js.mjs" line_range="1" />
<code_context>
const e=[`pointerdown`,`mousedown`,`pointerup`,`mouseup`,`click`],t=new WeakMap;function n(n,i,a){r(n);let o=e=>{let t=e.target;n.contains(t)&&((!a||a(t))&&(e.preventDefault(),e.stopPropagation(),e.stopImmediatePropagation()),e.type===`click`&&i?.(e))};for(let t of e)document.addEventListener(t,o,!0);t.set(n,o)}function r(n){let r=t.get(n);if(r){for(let t of e)document.removeEventListener(t,r,!0);t.delete(n)}}function i(e,t){let n=e.wrapper.getBoundingClientRect();return{width:n.width+t,height:n.height+t,realWidth:n.width,realHeight:n.height}}function a(e,t){let{elementDimensions:n,popoverDimensions:r,popoverPadding:i,popoverArrowDimensions:a}=t;return e===`start`?Math.max(Math.min(n.top-i,window.innerHeight-r.realHeight-a.width),a.width):e===`end`?Math.max(Math.min(n.top-r?.realHeight+n.height+i,window.innerHeight-r?.realHeight-a.width),a.width):e===`center`?Math.max(Math.min(n.top+n.height/2-r?.realHeight/2,window.innerHeight-r?.realHeight-a.width),a.width):0}function o(e,t){let{elementDimensions:n,popoverDimensions:r,popoverPadding:i,popoverArrowDimensions:a}=t;return e===`start`?Math.max(Math.min(n.left-i,window.innerWidth-r.realWidth-a.width),a.width):e===`end`?Math.max(Math.min(n.left-r?.realWidth+n.width+i,window.innerWidth-r?.realWidth-a.width),a.width):e===`center`?Math.max(Math.min(n.left+n.width/2-r?.realWidth/2,window.innerWidth-r?.realWidth-a.width),a.width):0}function s(e,t,n){let{align:r,side:s}=n,c=n.centered?`over`:s,l=n.padding,u=i(e,n.offset),f=e.arrow.getBoundingClientRect(),p=t.getBoundingClientRect(),m=p.top-u.height,h=m>=0,g=window.innerHeight-(p.bottom+u.height),_=g>=0,v=p.left-u.width,y=v>=0,b=window.innerWidth-(p.right+u.width),x=b>=0,S=!h&&!_&&!y&&!x,C=c;if(c===`top`&&h?x=y=_=!1:c===`bottom`&&_?x=y=h=!1:c===`left`&&y?x=h=_=!1:c===`right`&&x&&(y=h=_=!1),c===`over`){let t=window.innerWidth/2-u.realWidth/2,n=window.innerHeight/2-u.realHeight/2;e.wrapper.style.left=`${t}px`,e.wrapper.style.right=`auto`,e.wrapper.style.top=`${n}px`,e.wrapper.style.bottom=`auto`}else if(S){let t=window.innerWidth/2-u?.realWidth/2;e.wrapper.style.left=`${t}px`,e.wrapper.style.right=`auto`,e.wrapper.style.bottom=`10px`,e.wrapper.style.top=`auto`}else if(y){let t=Math.min(v,window.innerWidth-u?.realWidth-f.width),n=a(r,{elementDimensions:p,popoverDimensions:u,popoverPadding:l,popoverArrowDimensions:f});e.wrapper.style.left=`${t}px`,e.wrapper.style.top=`${n}px`,e.wrapper.style.bottom=`auto`,e.wrapper.style.right=`auto`,C=`left`}else if(x){let t=Math.min(b,window.innerWidth-u?.realWidth-f.width),n=a(r,{elementDimensions:p,popoverDimensions:u,popoverPadding:l,popoverArrowDimensions:f});e.wrapper.style.right=`${t}px`,e.wrapper.style.top=`${n}px`,e.wrapper.style.bottom=`auto`,e.wrapper.style.left=`auto`,C=`right`}else if(h){let t=Math.min(m,window.innerHeight-u.realHeight-f.width),n=o(r,{elementDimensions:p,popoverDimensions:u,popoverPadding:l,popoverArrowDimensions:f});e.wrapper.style.top=`${t}px`,e.wrapper.style.left=`${n}px`,e.wrapper.style.bottom=`auto`,e.wrapper.style.right=`auto`,C=`top`}else if(_){let t=Math.min(g,window.innerHeight-u?.realHeight-f.width),n=o(r,{elementDimensions:p,popoverDimensions:u,popoverPadding:l,popoverArrowDimensions:f});e.wrapper.style.left=`${n}px`,e.wrapper.style.bottom=`${t}px`,e.wrapper.style.top=`auto`,e.wrapper.style.right=`auto`,C=`bottom`}d(e,S?`over`:C,r,t),[...e.wrapper.classList].filter(e=>e.startsWith(`driver-popover-side-`)||e.startsWith(`driver-popover-align-`)).forEach(t=>e.wrapper.classList.remove(t)),e.wrapper.classList.add(`driver-popover-side-${C}`),e.wrapper.classList.add(`driver-popover-align-${r}`)}function c(e,t,n,r,i,a=10){let o=r-n;return e<=n&&t>=r?i===`start`?15+a/2:i===`end`?o-15-a/2:o/2:(Math.min(Math.max(e,n),r)+Math.min(Math.max(t,n),r))/2-n}function l(e,t,n=10){let r=t-15-n;if(r<15)return Math.max(0,(t-n)/2);let i=e-n/2;return Math.min(Math.max(i,15),r)}function u(e,t,n){return e===`left`||e===`right`?t.bottom>n.top&&t.top<n.bottom?e:t.bottom<=n.top?`bottom`:`top`:t.right>n.left&&t.left<n.right?e:t.right<=n.left?`right`:`left`}function d(e,t,n,r){let i=e.arrow;if(i.className=`driver-popover-arrow`,i.style.top=``,i.style.right=``,i.style.bottom=``,i.style.left=``,t===`over`){i.classList.add(`driver-popover-arrow-none`);return}let a=r.getBoundingClientRect(),o=e.wrapper.getBoundingClientRect(),s=u(t,a,o);i.classList.add(`driver-popover-arrow-side-${s}`);let d=i.getBoundingClientRect().width||10;if(s===`left`||s===`right`){let e=c(a.top,a.bottom,o.top,o.bottom,n,d);i.style.top=`${l(e,o.height,d)}px`}else{let e=c(a.left,a.right,o.left,o.right,n,d);i.style.left=`${l(e,o.width,d)}px`}}function f(e){return typeof e==`function`?e():typeof e==`string`?document.querySelector(e):e}function p(e){return!e||e.id===`driver-dummy-element`}function m(e){let t=window.getComputedStyle(e);return[t.overflow,t.overflowX,t.overflowY].some(e=>e===`auto`||e===`scroll`)}function h(e,t,n,r){return(e/=r/2)<1?n/2*e*e+t:-n/2*(--e*(e-2)-1)+t}function g(e){let t=[`a[href]`,`area[href]`,`button:not([disabled])`,`input:not([disabled]):not([type="hidden"])`,`select:not([disabled])`,`textarea:not([disabled])`,`summary`,`audio[controls]`,`video[controls]`,`[contenteditable]:not([contenteditable="false"])`,`[tabindex]:not([tabindex="-1"]):not([disabled])`].join(`, `);return e.flatMap(e=>{let n=e.matches(t),r=Array.from(e.querySelectorAll(t));return[...n?[e]:[],...r]}).filter(e=>getComputedStyle(e).pointerEvents!==`none`&&x(e))}function _(e,t){if(!e||y(e))return;let n=e.offsetHeight>window.innerHeight;e.scrollIntoView({behavior:!t||v(e)?`auto`:`smooth`,inline:`center`,block:n?`start`:`center`})}function v(e){if(!e||!e.parentElement)return;let t=e.parentElement;return t.scrollHeight>t.clientHeight}function y(e){let t=e.getBoundingClientRect();return t.top>=0&&t.left>=0&&t.bottom<=(window.innerHeight||document.documentElement.clientHeight)&&t.right<=(window.innerWidth||document.documentElement.clientWidth)&&!b(e,t)}function b(e,t){let n=e;for(;n;){if(getComputedStyle(n).position===`fixed`)return!1;let e=n.parentElement;if(!e||e===document.body||e===document.documentElement)return!1;if(m(e)){let n=e.getBoundingClientRect(),r=n.top+e.clientTop,i=n.left+e.clientLeft;if(t.top<r||t.left<i||t.bottom>r+(e.clientHeight||n.height)||t.right>i+(e.clientWidth||n.width))return!0}n=e}return!1}function x(e){return!!(e.offsetWidth||e.offsetHeight||e.getClientRects().length)}const S=new WeakSet;function C(e){let t=e.closest(`dialog[open]`);if(!t)return document.body;if(!(`showPopover`in t))return t;let n=t.querySelector(`:scope > .driver-layer`);return n||(n=document.createElement(`div`),n.className=`driver-layer`,n.setAttribute(`popover`,`manual`),t.appendChild(n)),S.has(t)||(S.add(t),t.addEventListener(`close`,()=>{t.querySelector(`:scope > .driver-layer:popover-open`)?.hidePopover()})),n.matches(`:popover-open`)||n.showPopover(),n}function ee(e){let t=e.parentElement;e.remove(),t?.classList.contains(`driver-layer`)&&!t.childElementCount&&t.remove()}const te=[`input`,`textarea`,`select`,`[role=combobox]`,`[role=grid]`,`[role=listbox]`,`[role=menu]`,`[role=menubar]`,`[role=radiogroup]`,`[role=slider]`,`[role=spinbutton]`,`[role=tablist]`,`[role=textbox]`,`[role=tree]`,`[role=treegrid]`].join(`, `);function ne(e){return e instanceof HTMLElement?e.isContentEditable||!!e.closest(te):!1}function w(e){e&&(e.wrapper.style.display=`none`)}const T=new WeakMap,E=new WeakMap;function D(e,t){E.get(e)!==t&&(e.innerHTML=t,E.set(e,t))}function O(e,t,n=`block`){e.style.display=t?n:`none`}function k(e,t){e.disabled=t,e.classList.toggle(`driver-popover-btn-disabled`,t)}function A(e,t){let{title:n,description:r,showButtons:i,disableButtons:a,showProgress:o,nextBtnText:s,prevBtnText:c,progressText:l}=t;D(e.nextButton,s),D(e.previousButton,c),D(e.progress,l),e.closeButton.setAttribute(`aria-label`,t.closeBtnLabel),e.nextButton.classList.toggle(`driver-popover-done-btn`,!!t.doneButton),n&&D(e.title,n),O(e.title,!!n),r&&D(e.description,r),O(e.description,!!r);let u=i.includes(`next`)||i.includes(`previous`)||o;O(e.closeButton,i.includes(`close`)),O(e.footer,u,`flex`),O(e.progress,o),O(e.nextButton,i.includes(`next`)),O(e.previousButton,i.includes(`previous`)),k(e.nextButton,a.includes(`next`)),k(e.previousButton,a.includes(`previous`)),k(e.closeButton,a.includes(`close`));let d=e.wrapper;d.classList.remove(...T.get(d)||[]);let f=(t.popoverClass||``).split(/\s+/).filter(Boolean);d.classList.add(...f),T.set(d,f)}function re(e,t){if(e.disabled)return!0;for(let n=e;n&&n!==t;n=n.parentElement)if(n.style?.display===`none`)return!0;return!1}function j(e,t,n){let r=document.activeElement,i=!!r&&e.wrapper.contains(r)&&r!==e.wrapper;A(e,n),i&&(!r.isConnected||re(r,e.wrapper))&&(e.wrapper.setAttribute(`tabindex`,`-1`),e.wrapper.focus()),s(e,t,n.position),N(e,t,n.position)}function M(e,t){let r=P();C(e).appendChild(r.wrapper);let i=r.wrapper;i.className=`driver-popover`,A(r,t),i.style.display=`block`,i.style.left=``,i.style.top=``,i.style.bottom=``,i.style.right=``,i.id=`driver-popover-content`,i.setAttribute(`role`,`dialog`),i.setAttribute(`aria-labelledby`,`driver-popover-title`),i.setAttribute(`aria-describedby`,`driver-popover-description`),r.arrow.className=`driver-popover-arrow`,n(r.wrapper,e=>{let n=e.target instanceof Element?e.target:e.target?.parentElement;if(n){if(n.closest(`.driver-popover-next-btn`))return t.onNextClick?.();if(n.closest(`.driver-popover-prev-btn`))return t.onPrevClick?.();if(n.closest(`.driver-popover-close-btn`))return t.onCloseClick?.()}},e=>r.description.contains(e)||r.title.contains(e)?!1:!!e.closest(`.driver-popover-prev-btn, .driver-popover-next-btn, .driver-popover-close-btn`)),t.onRender?.(r),s(r,e,t.position),N(r,e,t.position),_(i,t.smoothScroll);let a=t.keepFocus?[]:g([i,e]);return a.length>0&&a[0].focus(),r}function N(e,t,n){e.wrapper.querySelectorAll(`img`).forEach(r=>{if(r.complete)return;let i=()=>s(e,t,n);r.addEventListener(`load`,i,{once:!0}),r.addEventListener(`error`,i,{once:!0})})}function P(){let e=document.createElement(`div`);e.classList.add(`driver-popover`);let t=document.createElement(`div`);t.classList.add(`driver-popover-arrow`);let n=document.createElement(`div`);n.id=`driver-popover-title`,n.classList.add(`driver-popover-title`),n.style.display=`none`,n.innerText=`Popover Title`;let r=document.createElement(`div`);r.id=`driver-popover-description`,r.classList.add(`driver-popover-description`),r.style.display=`none`,r.innerText=`Popover description is here`;let i=document.createElement(`button`);i.type=`button`,i.classList.add(`driver-popover-close-btn`),i.innerHTML=`×`;let a=document.createElement(`div`);a.classList.add(`driver-popover-footer`);let o=document.createElement(`span`);o.classList.add(`driver-popover-progress-text`),o.innerText=``;let s=document.createElement(`span`);s.classList.add(`driver-popover-navigation-btns`);let c=document.createElement(`button`);c.type=`button`,c.classList.add(`driver-popover-prev-btn`,`driver-popover-footer-btn`),c.innerHTML=`Previous`;let l=document.createElement(`button`);return l.type=`button`,l.classList.add(`driver-popover-next-btn`,`driver-popover-footer-btn`),l.innerHTML=`Next`,s.appendChild(c),s.appendChild(l),a.appendChild(o),a.appendChild(s),e.appendChild(i),e.appendChild(t),e.appendChild(n),e.appendChild(r),e.appendChild(a),{wrapper:e,arrow:t,title:n,description:r,footer:a,previousButton:c,nextButton:l,closeButton:i,footerButtons:s,progress:o}}function F(e){e&&(r(e.wrapper),ee(e.wrapper))}function I(e,t){let n=window.innerWidth,r=window.innerHeight,i=t.padding,a=t.radius,o=e.width+i*2,s=e.height+i*2,c=Math.min(a,o/2,s/2),l=Math.floor(Math.max(c,0)),u=e.x-i+l,d=e.y-i,f=o-l*2,p=s-l*2;return`M${n},0L0,0L0,${r}L${n},${r}L${n},0Z
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-document-method):** User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>
### Comment 2
<location path="src/components/BootstrapBlazor.DriverJs/wwwroot/driver.js.mjs" line_range="1" />
<code_context>
const e=[`pointerdown`,`mousedown`,`pointerup`,`mouseup`,`click`],t=new WeakMap;function n(n,i,a){r(n);let o=e=>{let t=e.target;n.contains(t)&&((!a||a(t))&&(e.preventDefault(),e.stopPropagation(),e.stopImmediatePropagation()),e.type===`click`&&i?.(e))};for(let t of e)document.addEventListener(t,o,!0);t.set(n,o)}function r(n){let r=t.get(n);if(r){for(let t of e)document.removeEventListener(t,r,!0);t.delete(n)}}function i(e,t){let n=e.wrapper.getBoundingClientRect();return{width:n.width+t,height:n.height+t,realWidth:n.width,realHeight:n.height}}function a(e,t){let{elementDimensions:n,popoverDimensions:r,popoverPadding:i,popoverArrowDimensions:a}=t;return e===`start`?Math.max(Math.min(n.top-i,window.innerHeight-r.realHeight-a.width),a.width):e===`end`?Math.max(Math.min(n.top-r?.realHeight+n.height+i,window.innerHeight-r?.realHeight-a.width),a.width):e===`center`?Math.max(Math.min(n.top+n.height/2-r?.realHeight/2,window.innerHeight-r?.realHeight-a.width),a.width):0}function o(e,t){let{elementDimensions:n,popoverDimensions:r,popoverPadding:i,popoverArrowDimensions:a}=t;return e===`start`?Math.max(Math.min(n.left-i,window.innerWidth-r.realWidth-a.width),a.width):e===`end`?Math.max(Math.min(n.left-r?.realWidth+n.width+i,window.innerWidth-r?.realWidth-a.width),a.width):e===`center`?Math.max(Math.min(n.left+n.width/2-r?.realWidth/2,window.innerWidth-r?.realWidth-a.width),a.width):0}function s(e,t,n){let{align:r,side:s}=n,c=n.centered?`over`:s,l=n.padding,u=i(e,n.offset),f=e.arrow.getBoundingClientRect(),p=t.getBoundingClientRect(),m=p.top-u.height,h=m>=0,g=window.innerHeight-(p.bottom+u.height),_=g>=0,v=p.left-u.width,y=v>=0,b=window.innerWidth-(p.right+u.width),x=b>=0,S=!h&&!_&&!y&&!x,C=c;if(c===`top`&&h?x=y=_=!1:c===`bottom`&&_?x=y=h=!1:c===`left`&&y?x=h=_=!1:c===`right`&&x&&(y=h=_=!1),c===`over`){let t=window.innerWidth/2-u.realWidth/2,n=window.innerHeight/2-u.realHeight/2;e.wrapper.style.left=`${t}px`,e.wrapper.style.right=`auto`,e.wrapper.style.top=`${n}px`,e.wrapper.style.bottom=`auto`}else if(S){let t=window.innerWidth/2-u?.realWidth/2;e.wrapper.style.left=`${t}px`,e.wrapper.style.right=`auto`,e.wrapper.style.bottom=`10px`,e.wrapper.style.top=`auto`}else if(y){let t=Math.min(v,window.innerWidth-u?.realWidth-f.width),n=a(r,{elementDimensions:p,popoverDimensions:u,popoverPadding:l,popoverArrowDimensions:f});e.wrapper.style.left=`${t}px`,e.wrapper.style.top=`${n}px`,e.wrapper.style.bottom=`auto`,e.wrapper.style.right=`auto`,C=`left`}else if(x){let t=Math.min(b,window.innerWidth-u?.realWidth-f.width),n=a(r,{elementDimensions:p,popoverDimensions:u,popoverPadding:l,popoverArrowDimensions:f});e.wrapper.style.right=`${t}px`,e.wrapper.style.top=`${n}px`,e.wrapper.style.bottom=`auto`,e.wrapper.style.left=`auto`,C=`right`}else if(h){let t=Math.min(m,window.innerHeight-u.realHeight-f.width),n=o(r,{elementDimensions:p,popoverDimensions:u,popoverPadding:l,popoverArrowDimensions:f});e.wrapper.style.top=`${t}px`,e.wrapper.style.left=`${n}px`,e.wrapper.style.bottom=`auto`,e.wrapper.style.right=`auto`,C=`top`}else if(_){let t=Math.min(g,window.innerHeight-u?.realHeight-f.width),n=o(r,{elementDimensions:p,popoverDimensions:u,popoverPadding:l,popoverArrowDimensions:f});e.wrapper.style.left=`${n}px`,e.wrapper.style.bottom=`${t}px`,e.wrapper.style.top=`auto`,e.wrapper.style.right=`auto`,C=`bottom`}d(e,S?`over`:C,r,t),[...e.wrapper.classList].filter(e=>e.startsWith(`driver-popover-side-`)||e.startsWith(`driver-popover-align-`)).forEach(t=>e.wrapper.classList.remove(t)),e.wrapper.classList.add(`driver-popover-side-${C}`),e.wrapper.classList.add(`driver-popover-align-${r}`)}function c(e,t,n,r,i,a=10){let o=r-n;return e<=n&&t>=r?i===`start`?15+a/2:i===`end`?o-15-a/2:o/2:(Math.min(Math.max(e,n),r)+Math.min(Math.max(t,n),r))/2-n}function l(e,t,n=10){let r=t-15-n;if(r<15)return Math.max(0,(t-n)/2);let i=e-n/2;return Math.min(Math.max(i,15),r)}function u(e,t,n){return e===`left`||e===`right`?t.bottom>n.top&&t.top<n.bottom?e:t.bottom<=n.top?`bottom`:`top`:t.right>n.left&&t.left<n.right?e:t.right<=n.left?`right`:`left`}function d(e,t,n,r){let i=e.arrow;if(i.className=`driver-popover-arrow`,i.style.top=``,i.style.right=``,i.style.bottom=``,i.style.left=``,t===`over`){i.classList.add(`driver-popover-arrow-none`);return}let a=r.getBoundingClientRect(),o=e.wrapper.getBoundingClientRect(),s=u(t,a,o);i.classList.add(`driver-popover-arrow-side-${s}`);let d=i.getBoundingClientRect().width||10;if(s===`left`||s===`right`){let e=c(a.top,a.bottom,o.top,o.bottom,n,d);i.style.top=`${l(e,o.height,d)}px`}else{let e=c(a.left,a.right,o.left,o.right,n,d);i.style.left=`${l(e,o.width,d)}px`}}function f(e){return typeof e==`function`?e():typeof e==`string`?document.querySelector(e):e}function p(e){return!e||e.id===`driver-dummy-element`}function m(e){let t=window.getComputedStyle(e);return[t.overflow,t.overflowX,t.overflowY].some(e=>e===`auto`||e===`scroll`)}function h(e,t,n,r){return(e/=r/2)<1?n/2*e*e+t:-n/2*(--e*(e-2)-1)+t}function g(e){let t=[`a[href]`,`area[href]`,`button:not([disabled])`,`input:not([disabled]):not([type="hidden"])`,`select:not([disabled])`,`textarea:not([disabled])`,`summary`,`audio[controls]`,`video[controls]`,`[contenteditable]:not([contenteditable="false"])`,`[tabindex]:not([tabindex="-1"]):not([disabled])`].join(`, `);return e.flatMap(e=>{let n=e.matches(t),r=Array.from(e.querySelectorAll(t));return[...n?[e]:[],...r]}).filter(e=>getComputedStyle(e).pointerEvents!==`none`&&x(e))}function _(e,t){if(!e||y(e))return;let n=e.offsetHeight>window.innerHeight;e.scrollIntoView({behavior:!t||v(e)?`auto`:`smooth`,inline:`center`,block:n?`start`:`center`})}function v(e){if(!e||!e.parentElement)return;let t=e.parentElement;return t.scrollHeight>t.clientHeight}function y(e){let t=e.getBoundingClientRect();return t.top>=0&&t.left>=0&&t.bottom<=(window.innerHeight||document.documentElement.clientHeight)&&t.right<=(window.innerWidth||document.documentElement.clientWidth)&&!b(e,t)}function b(e,t){let n=e;for(;n;){if(getComputedStyle(n).position===`fixed`)return!1;let e=n.parentElement;if(!e||e===document.body||e===document.documentElement)return!1;if(m(e)){let n=e.getBoundingClientRect(),r=n.top+e.clientTop,i=n.left+e.clientLeft;if(t.top<r||t.left<i||t.bottom>r+(e.clientHeight||n.height)||t.right>i+(e.clientWidth||n.width))return!0}n=e}return!1}function x(e){return!!(e.offsetWidth||e.offsetHeight||e.getClientRects().length)}const S=new WeakSet;function C(e){let t=e.closest(`dialog[open]`);if(!t)return document.body;if(!(`showPopover`in t))return t;let n=t.querySelector(`:scope > .driver-layer`);return n||(n=document.createElement(`div`),n.className=`driver-layer`,n.setAttribute(`popover`,`manual`),t.appendChild(n)),S.has(t)||(S.add(t),t.addEventListener(`close`,()=>{t.querySelector(`:scope > .driver-layer:popover-open`)?.hidePopover()})),n.matches(`:popover-open`)||n.showPopover(),n}function ee(e){let t=e.parentElement;e.remove(),t?.classList.contains(`driver-layer`)&&!t.childElementCount&&t.remove()}const te=[`input`,`textarea`,`select`,`[role=combobox]`,`[role=grid]`,`[role=listbox]`,`[role=menu]`,`[role=menubar]`,`[role=radiogroup]`,`[role=slider]`,`[role=spinbutton]`,`[role=tablist]`,`[role=textbox]`,`[role=tree]`,`[role=treegrid]`].join(`, `);function ne(e){return e instanceof HTMLElement?e.isContentEditable||!!e.closest(te):!1}function w(e){e&&(e.wrapper.style.display=`none`)}const T=new WeakMap,E=new WeakMap;function D(e,t){E.get(e)!==t&&(e.innerHTML=t,E.set(e,t))}function O(e,t,n=`block`){e.style.display=t?n:`none`}function k(e,t){e.disabled=t,e.classList.toggle(`driver-popover-btn-disabled`,t)}function A(e,t){let{title:n,description:r,showButtons:i,disableButtons:a,showProgress:o,nextBtnText:s,prevBtnText:c,progressText:l}=t;D(e.nextButton,s),D(e.previousButton,c),D(e.progress,l),e.closeButton.setAttribute(`aria-label`,t.closeBtnLabel),e.nextButton.classList.toggle(`driver-popover-done-btn`,!!t.doneButton),n&&D(e.title,n),O(e.title,!!n),r&&D(e.description,r),O(e.description,!!r);let u=i.includes(`next`)||i.includes(`previous`)||o;O(e.closeButton,i.includes(`close`)),O(e.footer,u,`flex`),O(e.progress,o),O(e.nextButton,i.includes(`next`)),O(e.previousButton,i.includes(`previous`)),k(e.nextButton,a.includes(`next`)),k(e.previousButton,a.includes(`previous`)),k(e.closeButton,a.includes(`close`));let d=e.wrapper;d.classList.remove(...T.get(d)||[]);let f=(t.popoverClass||``).split(/\s+/).filter(Boolean);d.classList.add(...f),T.set(d,f)}function re(e,t){if(e.disabled)return!0;for(let n=e;n&&n!==t;n=n.parentElement)if(n.style?.display===`none`)return!0;return!1}function j(e,t,n){let r=document.activeElement,i=!!r&&e.wrapper.contains(r)&&r!==e.wrapper;A(e,n),i&&(!r.isConnected||re(r,e.wrapper))&&(e.wrapper.setAttribute(`tabindex`,`-1`),e.wrapper.focus()),s(e,t,n.position),N(e,t,n.position)}function M(e,t){let r=P();C(e).appendChild(r.wrapper);let i=r.wrapper;i.className=`driver-popover`,A(r,t),i.style.display=`block`,i.style.left=``,i.style.top=``,i.style.bottom=``,i.style.right=``,i.id=`driver-popover-content`,i.setAttribute(`role`,`dialog`),i.setAttribute(`aria-labelledby`,`driver-popover-title`),i.setAttribute(`aria-describedby`,`driver-popover-description`),r.arrow.className=`driver-popover-arrow`,n(r.wrapper,e=>{let n=e.target instanceof Element?e.target:e.target?.parentElement;if(n){if(n.closest(`.driver-popover-next-btn`))return t.onNextClick?.();if(n.closest(`.driver-popover-prev-btn`))return t.onPrevClick?.();if(n.closest(`.driver-popover-close-btn`))return t.onCloseClick?.()}},e=>r.description.contains(e)||r.title.contains(e)?!1:!!e.closest(`.driver-popover-prev-btn, .driver-popover-next-btn, .driver-popover-close-btn`)),t.onRender?.(r),s(r,e,t.position),N(r,e,t.position),_(i,t.smoothScroll);let a=t.keepFocus?[]:g([i,e]);return a.length>0&&a[0].focus(),r}function N(e,t,n){e.wrapper.querySelectorAll(`img`).forEach(r=>{if(r.complete)return;let i=()=>s(e,t,n);r.addEventListener(`load`,i,{once:!0}),r.addEventListener(`error`,i,{once:!0})})}function P(){let e=document.createElement(`div`);e.classList.add(`driver-popover`);let t=document.createElement(`div`);t.classList.add(`driver-popover-arrow`);let n=document.createElement(`div`);n.id=`driver-popover-title`,n.classList.add(`driver-popover-title`),n.style.display=`none`,n.innerText=`Popover Title`;let r=document.createElement(`div`);r.id=`driver-popover-description`,r.classList.add(`driver-popover-description`),r.style.display=`none`,r.innerText=`Popover description is here`;let i=document.createElement(`button`);i.type=`button`,i.classList.add(`driver-popover-close-btn`),i.innerHTML=`×`;let a=document.createElement(`div`);a.classList.add(`driver-popover-footer`);let o=document.createElement(`span`);o.classList.add(`driver-popover-progress-text`),o.innerText=``;let s=document.createElement(`span`);s.classList.add(`driver-popover-navigation-btns`);let c=document.createElement(`button`);c.type=`button`,c.classList.add(`driver-popover-prev-btn`,`driver-popover-footer-btn`),c.innerHTML=`Previous`;let l=document.createElement(`button`);return l.type=`button`,l.classList.add(`driver-popover-next-btn`,`driver-popover-footer-btn`),l.innerHTML=`Next`,s.appendChild(c),s.appendChild(l),a.appendChild(o),a.appendChild(s),e.appendChild(i),e.appendChild(t),e.appendChild(n),e.appendChild(r),e.appendChild(a),{wrapper:e,arrow:t,title:n,description:r,footer:a,previousButton:c,nextButton:l,closeButton:i,footerButtons:s,progress:o}}function F(e){e&&(r(e.wrapper),ee(e.wrapper))}function I(e,t){let n=window.innerWidth,r=window.innerHeight,i=t.padding,a=t.radius,o=e.width+i*2,s=e.height+i*2,c=Math.min(a,o/2,s/2),l=Math.floor(Math.max(c,0)),u=e.x-i+l,d=e.y-i,f=o-l*2,p=s-l*2;return`M${n},0L0,0L0,${r}L${n},${r}L${n},0Z
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-innerhtml):** User controlled data in a `e.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Link issues
fixes #1282
Summary By Copilot
Update the bundled Driver.js JavaScript and CSS assets to v1.11.0 and bump the component package version to 11.0.1-beta05.
Regression?
Risk
Low risk: this updates the upstream bundled assets and component package version only.
Verification
Automated:
dotnet build src\components\BootstrapBlazor.DriverJs\BootstrapBlazor.DriverJs.csproj --no-restore --verbosity quietpassed;node --check src\components\BootstrapBlazor.DriverJs\wwwroot\driver.js.mjspassed.Packaging changes reviewed?
☑️ Self Check before Merge
Summary by Sourcery
Enhancements: