From ea219f4ed83883d4354e7f13c0749ba300e3e130 Mon Sep 17 00:00:00 2001 From: gtmnayan <50981692+gtm-nayan@users.noreply.github.com> Date: Thu, 10 Nov 2022 17:39:25 +0545 Subject: [PATCH 1/2] [chore] patch bump tslib (#8015) closes #8013 ref: microsoft/tslib#160 --- package-lock.json | 14 +++++++------- package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index 28df4a5fcb..10deb8cbe5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -46,7 +46,7 @@ "source-map-support": "^0.5.21", "sourcemap-codec": "^1.4.8", "tiny-glob": "^0.2.9", - "tslib": "^2.4.0", + "tslib": "^2.4.1", "typescript": "^3.7.5" }, "engines": { @@ -4824,9 +4824,9 @@ } }, "node_modules/tslib": { - "version": "2.4.0", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.0.tgz", - "integrity": "sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ==", + "version": "2.4.1", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.1.tgz", + "integrity": "sha512-tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA==", "dev": true }, "node_modules/tsutils": { @@ -8939,9 +8939,9 @@ } }, "tslib": { - "version": "2.4.0", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.0.tgz", - "integrity": "sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ==", + "version": "2.4.1", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.1.tgz", + "integrity": "sha512-tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA==", "dev": true }, "tsutils": { diff --git a/package.json b/package.json index 331e1af772..52017504a5 100644 --- a/package.json +++ b/package.json @@ -152,7 +152,7 @@ "source-map-support": "^0.5.21", "sourcemap-codec": "^1.4.8", "tiny-glob": "^0.2.9", - "tslib": "^2.4.0", + "tslib": "^2.4.1", "typescript": "^3.7.5" } } From ee480bded663e3e345332da4a9cce53dd4ede9fb Mon Sep 17 00:00:00 2001 From: Dominik G Date: Thu, 10 Nov 2022 14:00:08 +0100 Subject: [PATCH 2/2] [fix] only read static value for rel attribute validation (#8003) fixes #7994 --- src/compiler/compile/nodes/Element.ts | 23 ++++++++++--------- .../input.svelte | 4 +++- 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/src/compiler/compile/nodes/Element.ts b/src/compiler/compile/nodes/Element.ts index 303b2e9122..ca9bcb8c4e 100644 --- a/src/compiler/compile/nodes/Element.ts +++ b/src/compiler/compile/nodes/Element.ts @@ -620,17 +620,18 @@ export default class Element extends Node { if (href_static_value === null || href_static_value.match(/^(https?:)?\/\//i)) { const rel = attribute_map.get('rel'); - const rel_values = rel ? rel.get_static_value().split(' ') : []; - const expected_values = ['noreferrer']; - - expected_values.forEach(expected_value => { - if (!rel || rel && rel_values.indexOf(expected_value) < 0) { - component.warn(this, { - code: `security-anchor-rel-${expected_value}`, - message: `Security: Anchor with "target=_blank" should have rel attribute containing the value "${expected_value}"` - }); - } - }); + if (rel == null || rel.is_static) { + const rel_values = rel ? rel.get_static_value().split(' ') : []; + const expected_values = ['noreferrer']; + expected_values.forEach(expected_value => { + if (!rel || rel && rel_values.indexOf(expected_value) < 0) { + component.warn(this, { + code: `security-anchor-rel-${expected_value}`, + message: `Security: Anchor with "target=_blank" should have rel attribute containing the value "${expected_value}"` + }); + } + }); + } } } diff --git a/test/validator/samples/security-anchor-rel-noreferrer/input.svelte b/test/validator/samples/security-anchor-rel-noreferrer/input.svelte index de52d5a596..f5361e5cfe 100644 --- a/test/validator/samples/security-anchor-rel-noreferrer/input.svelte +++ b/test/validator/samples/security-anchor-rel-noreferrer/input.svelte @@ -28,4 +28,6 @@ svelte website (valid) svelte website (valid) svelte website (valid) -svelte website (valid) \ No newline at end of file +svelte website (valid) + +svelte website (valid)