Resolve vulnerabilities

.github/workflows/coverage.yml

@@ -15,4 +15,4 @@ jobs:
       test_script: npx jest tests/static/ --coverage
       comparison_branch: master
     secrets:
-      caller_github_token: ${{ secrets.GITHUB_TOKEN }}
+      caller_github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/run-tests.yml

@@ -9,4 +9,4 @@ jobs:
   call_run_tests:
     uses: yext/slapshot-reusable-workflows/.github/workflows/run_tests.yml@v1
     with:
-      build_script: ''
+      build_script: ''

.github/workflows/wcag_test.yml

@@ -8,4 +8,4 @@ jobs:
   call_wcag_test:
     uses: yext/slapshot-reusable-workflows/.github/workflows/wcag_test.yml@v1
     with:
-      build_script: npm run setup-test-site && npm run build-test-site
+      build_script: npm run setup-test-site && npm run build-test-site

.gitignore

@@ -7,3 +7,4 @@ node_modules
 /playwright-report/
 /blob-report/
 /playwright/.cache/
+**/.env

static/js/theme-map/Maps/Providers/Baidu.js

@@ -307,7 +307,7 @@ class BaiduPin extends ProviderPin {
 
 // Load Function
 
-const yextAPIKey = 'bxNEoKKmzVSORkUQGwRxLbtis4Wwokdg';
+const yextAPIKey = process.env.BAIDU_API_KEY;
 const baseUrl = 'https://api.map.baidu.com/getscript';
 
 /**
@@ -350,7 +350,7 @@ function load(resolve, reject, apiKey, {
   }
 
   const negativeLngFixStyle = document.createElement('style');
-  negativeLngFixStyle.innerHTML = negativeLngFixCSS;
+  negativeLngFixStyle.innerText = negativeLngFixCSS;
 
   document.head.appendChild(negativeLngFixStyle);
 }

static/js/theme-map/Util/Accessibility.js

@@ -33,9 +33,9 @@ export class AccessibilityHelpers {
 export const AccessibilityChecks = {
   checkAltTags: function () {
     const accessibilityStyleSheet = document.createElement('style');
-    accessibilityStyleSheet.innerHTML = `img:not([alt]) { outline: ${outlineStyle}; }`;
+    accessibilityStyleSheet.innerText = `img:not([alt]) { outline: ${outlineStyle}; }`;
     for (let selector of whitelist) {
-      accessibilityStyleSheet.innerHTML += `${selector} img:not([alt]) { outline: none; }`;
+      accessibilityStyleSheet.innerText += `${selector} img:not([alt]) { outline: none; }`;
     }
     document.head.appendChild(accessibilityStyleSheet);
   }

static/package.json

@@ -23,6 +23,7 @@
     "comment-json": "^4.1.1",
     "css-loader": "^3.4.2",
     "currency-symbol-map": "^5.0.1",
+    "dotenv": "^16.4.1",
     "esbuild-loader": "^2.13.1",
     "file-system": "^2.2.2",
     "fs-extra": "^9.0.1",

static/webpack-config.js

@@ -71,7 +71,7 @@ module.exports = function () {
     ...cssRtlPlugin,
     ...htmlPlugins,
     new webpack.DefinePlugin({
-      'process.env.JAMBO_INJECTED_DATA': JSON.stringify(jamboInjectedData)
+      'process.env.JAMBO_INJECTED_DATA': JSON.stringify(jamboInjectedData),
     }),
     new RemovePlugin({
       after: {

static/webpack/InlineAssetHtmlPlugin.js

@@ -25,7 +25,7 @@ class InlineAssetHtmlPlugin {
    * HTML elements are only replaced with inlined versions if they have the data attribute
    * "data-webpack-inline"
    *
-   * @param {String} html The html of the page to analyze tags and replace with inlined 
+   * @param {String} html The html of the page to analyze tags and replace with inlined
    * @param {Object<String, Source>} assetsMap Mapping from asset name to asset content,
    *                                           provided by webpack compilation
    */
@@ -48,7 +48,7 @@ class InlineAssetHtmlPlugin {
       const scriptSource = scriptNode.src;
       const fileContents = this._getAssetContents(scriptSource, assetsMap);
 
-      scriptNode.innerHTML = fileContents;
+      scriptNode.textContent = fileContents;
       scriptNode.dataset.fileName = scriptSource;
       scriptNode.removeAttribute('src');
     });
@@ -68,7 +68,7 @@ class InlineAssetHtmlPlugin {
       const transformedCss = this._transformCssUrls(rawContents, relativePath);
 
       const styleNode = dom.window.document.createElement('style');
-      styleNode.innerHTML = transformedCss;
+      styleNode.textContent = transformedCss;
       styleNode.dataset.fileName = linkNode.href;
       styleNode.dataset.webpackInline = '';
       linkNode.parentNode.insertBefore(styleNode, linkNode.nextSibling);

test-site/scripts/build.sh

@@ -7,4 +7,4 @@ set_working_dir_to_test_site () {
 
 set_working_dir_to_test_site
 
-npx jambo build && npx grunt webpack
+npx jambo build && npx grunt webpack