diff --git a/packages/scan/src/auto.ts b/packages/scan/src/auto.ts index d2251b14..e7d54f0f 100644 --- a/packages/scan/src/auto.ts +++ b/packages/scan/src/auto.ts @@ -3,10 +3,46 @@ import './polyfills'; import 'bippy'; import { IS_CLIENT } from '~web/utils/constants'; -import { scan } from './index'; +import { type Options, scan } from './index'; + +const isObjectRecord = (value: unknown): value is Record => + typeof value === 'object' && value !== null; + +// Allowlist + per-field type validation. Mirrors react-grab's +// `parseOptionsFromJson` — never spread untrusted JSON into the options +// object, since that could inject internal/dangerous flags. Add new +// keys here as the need arises. +const parseOptionsFromJson = (raw: unknown): Options => { + const out: Options = {}; + if (!isObjectRecord(raw)) return out; + + if (typeof raw.enabled === 'boolean') out.enabled = raw.enabled; + + return out; +}; + +// Read configuration from a `data-options='{"enabled":false}'` attribute on +// the loading