Resolve vulnerabilities

.github/workflows/acceptance_headless.yml

@@ -6,6 +6,8 @@ jobs:
   headless-acceptance-tests:
     name: Chrome Acceptance Tests (Headless)
     runs-on: ubuntu-latest
+    env: 
+      MAPBOX_KEY: ${{ secrets.MAPBOX_KEY }}
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3

.github/workflows/coverage.yml

@@ -16,3 +16,4 @@ jobs:
       comparison_branch: master
     secrets:
       caller_github_token: ${{ secrets.GITHUB_TOKEN }}
+

.github/workflows/run-tests.yml

@@ -10,3 +10,5 @@ jobs:
     uses: yext/slapshot-reusable-workflows/.github/workflows/run_tests.yml@v1
     with:
       build_script: ''
+    secrets:
+      MAPBOX_KEY: ${{ secrets.MAPBOX_KEY }}

.github/workflows/wcag_test.yml

@@ -8,4 +8,4 @@ jobs:
   call_wcag_test:
     uses: yext/slapshot-reusable-workflows/.github/workflows/wcag_test.yml@v1
     with:
-      build_script: npm run setup-test-site && npm run build-test-site
+      build_script: npm run setup-test-site && npm run build-test-site

.gitignore

@@ -7,3 +7,4 @@ node_modules
 /playwright-report/
 /blob-report/
 /playwright/.cache/
+**/.env

static/js/default-map-api-key.js

@@ -13,7 +13,7 @@ export function getDefaultMapApiKey(mapProvider) {
       case 'google':
         return 'AIzaSyB5D45ghF1YMfqTLSzWubmlCN1euBVPhFw';
       case 'mapbox':
-        return 'pk.eyJ1IjoieWV4dCIsImEiOiJqNzVybUhnIn0.hTOO5A1yqfpN42-_z_GuLw';
+        return process.env.MAPBOX_KEY;
       default:
         throw new Error(
           `Given mapProvider: '${mapProvider}' is invalid. Expects either 'google' or 'mapbox'.`

static/js/theme-map/Maps/Providers/Baidu.js

@@ -307,7 +307,7 @@ class BaiduPin extends ProviderPin {
 
 // Load Function
 
-const yextAPIKey = 'bxNEoKKmzVSORkUQGwRxLbtis4Wwokdg';
+const yextAPIKey = process.env.BAIDU_KEY;
 const baseUrl = 'https://api.map.baidu.com/getscript';
 
 /**
@@ -350,7 +350,7 @@ function load(resolve, reject, apiKey, {
   }
 
   const negativeLngFixStyle = document.createElement('style');
-  negativeLngFixStyle.innerHTML = negativeLngFixCSS;
+  negativeLngFixStyle.innerText = negativeLngFixCSS;
 
   document.head.appendChild(negativeLngFixStyle);
 }

static/js/theme-map/Maps/Providers/Leaflet.js

@@ -119,7 +119,7 @@ class LeafletPin extends ProviderPin {
 
 // Load Function
 
-const yextAPIKey = 'pk.eyJ1IjoieWV4dCIsImEiOiJqNzVybUhnIn0.hTOO5A1yqfpN42-_z_GuLw';
+const yextAPIKey = process.env.MAPBOX_KEY;
 const baseUrl = 'https://unpkg.com/leaflet@1.6.0/dist/leaflet';
 
 /**

static/js/theme-map/Maps/Providers/Mapbox.js

@@ -175,7 +175,7 @@ class MapboxPin extends ProviderPin {
 
 // Load Function
 
-const yextAPIKey = 'pk.eyJ1IjoieWV4dCIsImEiOiJqNzVybUhnIn0.hTOO5A1yqfpN42-_z_GuLw';
+const yextAPIKey = process.env.MAPBOX_KEY;
 
 /**
  * This function is called when calling {@link MapProvider#load} on {@link module:Maps/Providers/Mapbox.MapboxMaps}.

static/js/theme-map/Util/Accessibility.js

@@ -33,9 +33,9 @@ export class AccessibilityHelpers {
 export const AccessibilityChecks = {
   checkAltTags: function () {
     const accessibilityStyleSheet = document.createElement('style');
-    accessibilityStyleSheet.innerHTML = `img:not([alt]) { outline: ${outlineStyle}; }`;
+    accessibilityStyleSheet.innerText = `img:not([alt]) { outline: ${outlineStyle}; }`;
     for (let selector of whitelist) {
-      accessibilityStyleSheet.innerHTML += `${selector} img:not([alt]) { outline: none; }`;
+      accessibilityStyleSheet.innerText += `${selector} img:not([alt]) { outline: none; }`;
     }
     document.head.appendChild(accessibilityStyleSheet);
   }