diff --git a/.github/workflows/test-and-publish-app.yml b/.github/workflows/test-and-publish-app.yml index 6ab36c7d..eaf66698 100644 --- a/.github/workflows/test-and-publish-app.yml +++ b/.github/workflows/test-and-publish-app.yml @@ -6,10 +6,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 + - uses: actions/checkout@v6.0.2 + - uses: actions/setup-node@v6.3.0 with: - node-version: 20 + node-version: 24 - name: 🔧 Install run: | yarn @@ -28,7 +28,7 @@ jobs: yarn build-storybook - name: 🚀 Deploy Storybook if: github.ref == 'refs/heads/main' - uses: JamesIves/github-pages-deploy-action@v4.3.3 + uses: JamesIves/github-pages-deploy-action@v4.6.8 with: github-token: ${{ secrets.GITHUB_TOKEN }} branch: gh-pages # The branch the action should deploy to. diff --git a/package.json b/package.json index 3fd81155..481a5b4d 100644 --- a/package.json +++ b/package.json @@ -73,8 +73,5 @@ "packages/*" ], "customElements": "custom-elements.json", - "sideEffects": false, - "dependencies": { - "rimraff": "0.0.1-security" - } + "sideEffects": false } diff --git a/packages/nightingale-msa/src/workers/conservation-inline-worker.ts b/packages/nightingale-msa/src/workers/conservation-inline-worker.ts index 76de7e2c..70e0f522 100644 --- a/packages/nightingale-msa/src/workers/conservation-inline-worker.ts +++ b/packages/nightingale-msa/src/workers/conservation-inline-worker.ts @@ -48,6 +48,12 @@ export const calculateConservation = ( // Note that the line `const f = ${calculateConservation.toString()};` allows us to keep that // function's source code in TypeScript while also being transpiled into JavaScript. +// +// SECURITY: This pattern constructs code-as-string for a Blob-based Web Worker. +// The Worker ONLY receives bioinformatics sequence data from the same origin. +// Do NOT interpolate any untrusted or user-supplied data into this template string. +// If this pattern needs to change, consider migrating to a standard Worker with a +// bundled module file to restore TypeScript type safety and avoid code injection risks. const conservationInlineWorkerString = ` self.addEventListener('message', (e) => { if (self.previous !== e.data) { diff --git a/packages/nightingale-scrollbox/package.json b/packages/nightingale-scrollbox/package.json index a9956626..6a49580b 100644 --- a/packages/nightingale-scrollbox/package.json +++ b/packages/nightingale-scrollbox/package.json @@ -34,6 +34,7 @@ }, "sideEffects": false, "dependencies": { - "@nightingale-elements/nightingale-new-core": "^5.6.0" + "@nightingale-elements/nightingale-new-core": "^5.6.0", + "dompurify": "^3.0.0" } } diff --git a/packages/nightingale-scrollbox/src/nightingale-scrollbox-item.ts b/packages/nightingale-scrollbox/src/nightingale-scrollbox-item.ts index 5dbfb433..d71d7b41 100644 --- a/packages/nightingale-scrollbox/src/nightingale-scrollbox-item.ts +++ b/packages/nightingale-scrollbox/src/nightingale-scrollbox-item.ts @@ -1,5 +1,6 @@ import NightingaleElement from "@nightingale-elements/nightingale-new-core"; import { customElement, property } from "lit/decorators.js"; +import DOMPurify from "dompurify"; import { NightingaleScrollbox } from "./nightingale-scrollbox"; @@ -85,7 +86,7 @@ export class NightingaleScrollboxItem extends NightingaleElement { private setContent(content: string | null | undefined) { if (content === undefined || content === null) return; - this.innerHTML = content; + this.innerHTML = DOMPurify.sanitize(content); } /** Set or remove "onRegister" callback function. Also run this callback function if the item is already registered (i.e. in "new", "visible", or "hidden" state). */ diff --git a/packages/nightingale-structure/package.json b/packages/nightingale-structure/package.json index 048f48b8..ed1d6a58 100644 --- a/packages/nightingale-structure/package.json +++ b/packages/nightingale-structure/package.json @@ -38,6 +38,7 @@ "dependencies": { "@nightingale-elements/nightingale-new-core": "^5.6.0", "d3": "7.9.0", + "dompurify": "^3.0.0", "molstar": "3.44.0" } } diff --git a/packages/nightingale-structure/src/nightingale-structure.ts b/packages/nightingale-structure/src/nightingale-structure.ts index 2e46c9da..7e825157 100644 --- a/packages/nightingale-structure/src/nightingale-structure.ts +++ b/packages/nightingale-structure/src/nightingale-structure.ts @@ -1,6 +1,7 @@ /* eslint-disable class-methods-use-this */ import { html, nothing } from "lit"; import { property, state } from "lit/decorators.js"; +import DOMPurify from "dompurify"; import NightingaleElement, { withHighlight, @@ -93,7 +94,7 @@ const alphaFoldMappingUrl = "https://alphafold.ebi.ac.uk/api/prediction/"; @customElementOnce("nightingale-structure") class NightingaleStructure extends withManager( - withHighlight(NightingaleElement) + withHighlight(NightingaleElement), ) { @property({ type: String }) "protein-accession"?: string; @@ -191,7 +192,7 @@ class NightingaleStructure extends withManager( ${this.message?.title}: