feat/#227-resolve-xss-vulnerabilities (#300)

Co-authored-by: Dmitry Baev <baev.dm@gmail.com>

- Add `DOMPurify` as the main sanitizer library
- Change HTML attachments to use `iframe` isolation instead of the risky `dangerouslySetInnerHTML`
- Detach some `plugin-*` packages from the `web-commons` package that affects the build target

Author: Viperwow

.pnp.cjs

@@ -9,6 +9,7 @@ export type * from "./model.js";
 export type * from "./testCase.js";
 export type * from "./testPlan.js";
 export type * from "./config.js";
+export * from "./static.js";
 export * from "./utils/step.js";
 export type * from "./utils/tree.js";
 export * from "./utils/time.js";

.yarn/cache/@types-trusted-types-npm-2.0.7-a07fc44f59-8e4202766a.zip

@@ -27,3 +27,41 @@ export const createBaseUrlScript = () => {
     </script>
   `;
 };
+
+export const createReportDataScript = (
+  reportFiles: {
+    name: string;
+    value: string;
+  }[] = [],
+) => {
+  if (!reportFiles?.length) {
+    return `
+      <script async>
+        window.allureReportDataReady = true;
+      </script>
+    `;
+  }
+
+  const reportFilesDeclaration = reportFiles.map(({ name, value }) => `d('${name}','${value}')`).join(",");
+
+  return `
+    <script async>
+      window.allureReportDataReady = false;
+      window.allureReportData = window.allureReportData || {};
+
+      function d(name, value){
+        return new Promise(function (resolve) {
+          window.allureReportData[name] = value;
+
+          return resolve(true);
+        });
+      }
+    </script>
+    <script defer>
+      Promise.allSettled([${reportFilesDeclaration}])
+        .then(function(){
+          window.allureReportDataReady = true;
+        })
+    </script>
+  `;
+};

.yarn/cache/dompurify-npm-3.2.6-8d2a7542b7-b91631ed0e.zip

@@ -33,7 +33,6 @@
     "@allurereport/core-api": "workspace:*",
     "@allurereport/plugin-api": "workspace:*",
     "@allurereport/web-allure2": "workspace:*",
-    "@allurereport/web-commons": "workspace:*",
     "handlebars": "^4.7.8"
   },
   "devDependencies": {

packages/core-api/src/index.ts

@@ -1,13 +1,13 @@
 import type { AttachmentLink, HistoryDataPoint, Statistic } from "@allurereport/core-api";
-import type { ReportFiles, ResultFile } from "@allurereport/plugin-api";
-import type { Allure2ReportOptions } from "@allurereport/web-allure2";
 import {
   createBaseUrlScript,
   createFaviconLinkTag,
   createReportDataScript,
   createScriptTag,
   createStylesLinkTag,
-} from "@allurereport/web-commons";
+} from "@allurereport/core-api";
+import type { ReportFiles, ResultFile } from "@allurereport/plugin-api";
+import type { Allure2ReportOptions } from "@allurereport/web-allure2";
 import Handlebars from "handlebars";
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";

packages/web-commons/src/static.ts renamed to packages/core-api/src/static.ts

@@ -14,7 +14,7 @@ import type {
   TrendSlice,
   TrendSliceId,
 } from "@allurereport/core-api";
-import { ChartType, ChartDataType, ChartMode, getPieChartValues } from "@allurereport/core-api";
+import { ChartDataType, ChartMode, ChartType, getPieChartValues } from "@allurereport/core-api";
 import type { PluginContext } from "./plugin.js";
 import { severityTrendDataAccessor } from "./severityTrendAccessor.js";
 import { statusBySeverityBarDataAccessor } from "./statusBySeverityBarAccessor.js";

packages/plugin-allure2/package.json

@@ -33,7 +33,6 @@
     "@allurereport/core-api": "workspace:*",
     "@allurereport/plugin-api": "workspace:*",
     "@allurereport/web-awesome": "workspace:*",
-    "@allurereport/web-commons": "workspace:*",
     "d3-shape": "^3.2.0",
     "handlebars": "^4.7.8"
   },

packages/plugin-allure2/src/generators.ts

@@ -7,6 +7,11 @@ import {
   type TestResult,
   type TreeData,
   compareBy,
+  createBaseUrlScript,
+  createFontLinkTag,
+  createReportDataScript,
+  createScriptTag,
+  createStylesLinkTag,
   getPieChartValues,
   incrementStatistic,
   nullsLast,
@@ -33,13 +38,6 @@ import type {
   AwesomeTreeGroup,
   AwesomeTreeLeaf,
 } from "@allurereport/web-awesome";
-import {
-  createBaseUrlScript,
-  createFontLinkTag,
-  createReportDataScript,
-  createScriptTag,
-  createStylesLinkTag,
-} from "@allurereport/web-commons";
 import Handlebars from "handlebars";
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";