Files
site-builder/craft/src/components/basic/Footer.tsx
T
shadowdaoandClaude Opus 4.8 591a51dcc2 fix(builder): escape/allowlist all attribute-value sinks incl. numeric/enum props (XSS)
An adversarial pass found 5 Critical XSS sinks where props declared number/enum
in TypeScript were interpolated raw into exported HTML attribute values,
trusting the type — but nothing enforces it at runtime (AI update_props only
validates node_id; deserialized saved state is untyped JSON). Fixed all 5
(NumberCounter data-target, StarRating aria-label, FormContainer method,
ContactForm/InputField input type) plus 6 sibling sinks found by an exhaustive
audit of every attribute-value interpolation across src/components: a
JS-source injection into ContentSlider's inline setInterval script, a
prototype-pollution-adjacent allowlist gap in Section's divider-shape lookup,
TextareaField rows, Testimonials rating aria-label, HeroSimple textAlign, and
MapEmbed zoom. Adds shared sanitizeFormMethod/sanitizeInputType allowlist
helpers to utils/escape.ts alongside the existing escapeAttr/safeUrl/cssValue
primitives. Every fix is TDD'd: a malicious-value test reproduces the raw
injection against the pre-fix code, then passes after the fix.

502 tests green (npx vitest run), tsc + vite build green (npm run build).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 18:03:44 -07:00

114 lines
3.1 KiB
TypeScript

import React, { CSSProperties, useCallback, useRef, useEffect } from 'react';
import { useNode, UserComponent } from '@craftjs/core';
import { cssPropsToString } from '../../utils/style-helpers';
import { escapeHtml } from '../../utils/escape';
interface FooterProps {
text?: string;
style?: CSSProperties;
}
export const Footer: UserComponent<FooterProps> = ({
text = '© 2026 MySite. All rights reserved.',
style = {},
}) => {
const {
connectors: { connect, drag },
selected,
actions: { setProp },
} = useNode((node) => ({
selected: node.events.selected,
}));
const elRef = useRef<HTMLElement | null>(null);
const editedTextRef = useRef<string | null>(null);
const commitText = useCallback(() => {
if (elRef.current) {
const newText = elRef.current.innerText;
editedTextRef.current = newText;
setProp((p: FooterProps) => { p.text = newText; }, 500);
}
}, [setProp]);
// Commit on blur
const handleBlur = useCallback(() => { commitText(); }, [commitText]);
// Also commit on deselect via effect -- covers the case where selection
// clears without a real blur (e.g. clicking a different element that
// steals selection programmatically), which used to lose the in-progress
// edit. Mirrors Heading.tsx's mechanism.
useEffect(() => {
if (!selected && editedTextRef.current !== null) {
setProp((p: FooterProps) => { p.text = editedTextRef.current!; }, 500);
editedTextRef.current = null;
}
}, [selected, setProp]);
// Set DOM text on mount and when text prop changes externally (not during editing)
useEffect(() => {
if (elRef.current && !selected && editedTextRef.current === null) {
elRef.current.innerText = text || '';
}
}, [text, selected]);
return (
<footer
ref={(ref: HTMLElement | null): void => {
elRef.current = ref;
if (ref) connect(drag(ref));
}}
contentEditable={selected}
suppressContentEditableWarning
onBlur={handleBlur}
onInput={() => {
// Track that we have unsaved edits
if (elRef.current) {
editedTextRef.current = elRef.current.innerText;
}
}}
style={{
padding: '24px 20px',
textAlign: 'center',
outline: 'none',
cursor: selected ? 'text' : 'pointer',
...style,
}}
>
{selected ? undefined : (text || '')}
</footer>
);
};
/* ---------- Craft config ---------- */
Footer.craft = {
displayName: 'Footer',
props: {
text: '© 2026 MySite. All rights reserved.',
style: {
backgroundColor: '#18181b',
color: '#a1a1aa',
fontSize: '14px',
padding: '24px 20px',
},
},
rules: {
canDrag: () => true,
canMoveIn: () => false,
canMoveOut: () => true,
},
};
/* ---------- HTML export ---------- */
(Footer as any).toHtml = (props: FooterProps, _childrenHtml: string) => {
const styleStr = cssPropsToString({
padding: '24px 20px',
textAlign: 'center',
...props.style,
});
const escapedText = escapeHtml(props.text || '');
return { html: `<footer${styleStr ? ` style="${styleStr}"` : ''}>${escapedText}</footer>` };
};