CINT-3870 Modernize examples, upgrade to latest framework versions, remediate Angular CVEs - #51
Draft
chrishollman wants to merge 5 commits into
Draft
CINT-3870 Modernize examples, upgrade to latest framework versions, remediate Angular CVEs#51chrishollman wants to merge 5 commits into
chrishollman wants to merge 5 commits into
Conversation
Fix the setupEnforcement race condition (CINT-3870) where window.setupEnforcement was assigned in an onload handler, causing api.js to miss the callback and fall back to a 1-second retry on ~50% of traffic for affected customers. CDN examples: fix cookie-clearing bug across 6 files, fix variable name mismatches in Auth0 workers, add missing return in DX worker, change 301 to 302 redirects, move private key from GET to POST body, add async to script tags, ES6+ modernization, accessibility fixes. Multi-key example: fix broken closing div tags, add DOCTYPE/viewport, fix XSS risk (innerHTML to textContent), add origin validation on postMessage, replace deprecated parcel-bundler with npx serve, add error callbacks. React example: migrate from Create React App to Vite, upgrade to React 19 and react-router-dom v7, convert Arkose class component to functional with hooks (forwardRef, useImperativeHandle, callbacksRef pattern), fix setupEnforcement race condition. Vue example: migrate from Vue 2 + Vue CLI to Vue 3 + Vite, rewrite all components with Composition API and script setup, remove window.myEnforcement global. Angular example: migrate from Angular 13 to Angular 19 with standalone components, signal-based inputs/outputs, inject(), viewChild(), lazy-loaded routes, esbuild. React Native example: update to RN 0.79 and React 19, add TypeScript, create typed HTML builder, replace dead dependencies, fix JSON.parse crash and invalid overflow style. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add script onerror handlers (React, Vue, Angular), remove dead code (Angular resetting field, deprecated react-test-renderer), add res.ok checks and try/catch in CDN fetch calls, fix multi-key start-iframe script, clean up redundant script.type attributes, and update READMEs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fix callback-race safety and cross-framework consistency in the modernized examples: - Unify onError contract to emit the Arkose error code string across React/Vue/Angular (fixes Vue alert() showing "[object Object]"); align to real client-api payload shape - Guard window.setupEnforcement cleanup with an identity check so overlapping mount/unmount cannot clobber another instance's callback (React, Angular) - Angular: guard async onError against post-destroy emit; standardize inline prop to `selector` (full CSS selector) to match React/Vue; correct error/failed types - React Native: define setupEnforcement before the async api.js tag; scope WebView originWhitelist to https; restore react-test-renderer so the jest test runs; drop the broken eslint lint script - Untrack android/local.properties (committed dev SDK path) and fix nested gitignore glob - Remove unused @angular/forms; add engines.node >= 18; document server-side verification / nonce / run() / retry behavior in READMEs Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio. |
![wiz-code-arkose-labs[bot]](https://avatars.githubusercontent.com/u/5441327?s=60&v=4){kind=small}
…e Angular CVEs Remediates the Wiz-flagged CVE-2026-54266/54267/54268 (@angular/core & @angular/common < 20.3.25) and brings every example to the latest stable versions. Commits lockfiles for reproducible, scannable, CVE-free dependency resolution. - Angular 19 -> 22.0.8 (TypeScript 6.0, zone.js 0.16, rxjs 7.8; dropped unused @angular/platform-browser-dynamic). Fixes NG5002 self-closing element. ng build PASS; shipped app: 0 audit vulns; @angular/core & @angular/common resolve to 22.0.8. - React: React 19.2, Vite 8, and migrated off legacy react-router-dom to react-router 8.3.0 (modern single-package import), which clears the react-router advisory chain. build PASS; 0 audit vulns. - Vue 3.5.40, vue-router 5, Vite 8. build PASS; 0 audit vulns. - React Native 0.79 -> 0.86 (react 19.2, react-native-webview 14, @react-native/* 0.86, jest 29 to match the RN 0.86 template, TypeScript 5.9). Removed Flipper (deleted ReactNativeFlipper.java, cleaned MainApplication.java), migrated Android/iOS native scaffolding to the 0.86 template (Gradle 9, SDK 36, Flipper-free Podfile). tsc + jest PASS. - engines.node bumped to each toolchain's requirement; Angular README version updated. Verification: React/Vue/Angular built; RN typechecked and unit-tested. The RN native android/ios BUILD was not run (no Android SDK/Xcode in CI) and must be validated on a dev machine. Remaining audit findings are dev/test-tooling only (Angular CLI's transitive MCP sdk; RN's jest/babel chain) and are absent from the shipped bundles. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
chrishollman
changed the title
…t tags CAPI (api.js) should not be loaded asynchronously. Dynamically injected scripts are force-async by default, so setting async=false explicitly is required (deleting the line alone would leave them async). - React/Vue/Angular wrappers: script.async = true -> false - multi-key + Auth0/DX CDN workers: injected api.js scripts were force-async by default; added script.async = false - React Native inline HTML + CDN client HTML (button/form takeover, akamai-proxy): removed the `async` attribute from the api.js <script> tag No `defer` was present on any CAPI script. The akamai-edgeworker inject uses parser-inserted markup with no async attribute (already non-async), left unchanged. Web builds + RN typecheck pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA Ticket
https://arkoselabs.atlassian.net/browse/CINT-3870
Overview
Modernizes all Arkose example integrations, fixes the CINT-3870 callback race (api.js executing before
window.setupEnforcementis registered), addresses multi-model review findings, and upgrades every example to the latest stable framework versions to remediate the Wiz-flagged Angular CVEs.Change summary
CVE remediation (Wiz): CVE-2026-54266 / 54267 / 54268 affected
@angular/coreand@angular/common< 20.3.25. Angular is upgraded to 22.0.8;npm lsconfirms both resolve to 22.0.8. Lockfiles are now committed so the CVE-free resolution is pinned and scannable.Latest-version upgrades (all build/test-verified where possible):
@angular/platform-browser-dynamic; fixed NG5002 self-closing element.ng buildPASS. Shipped app: 0 audit vulnerabilities.react-router-domtoreact-router8.3.0 (the modern single-package import), which clears the entire react-router advisory chain.vite buildPASS. 0 audit vulnerabilities.vite buildPASS. 0 audit vulnerabilities.@react-native/*0.86, jest 29 (matching the official RN 0.86 template), TypeScript 5.9. Removed Flipper (deletedReactNativeFlipper.java, cleanedMainApplication.java) and migrated the Android/iOS native scaffolding to the 0.86 template (Gradle 9, SDK 36, Flipper-free Podfile).tsc+jestPASS.engines.nodebumped to each toolchain's requirement.Earlier changes retained: callback-race fix across all frameworks; unified string
onErrorcontract; identity-guardedwindow.setupEnforcementcleanup; Angular post-destroy guard +selectorprop standardization; RN WebVieworiginWhitelistscoped to https;android/local.propertiesuntracked; server-side-verification / nonce / run() README notes.Does this PR introduce a breaking change?
Not for end users. Component APIs changed for anyone who copied the pre-fix examples (Angular
selectorId→selector;onErroremits a string). React example now imports fromreact-routerinstead ofreact-router-dom.How has this been tested?
npm install+ production build all PASS;npm auditclean (0 vulns for React/Vue; Angular shipped app 0, its 3 remaining moderates are dev-only@angular/clitransitive tooling not in the bundle).npx tsc --noEmitandnpm test(jest) PASS. The native Android/iOS build was NOT run (no Android SDK / Xcode in this environment) — a maintainer must validate./gradlew assembleDebugandpod install+ iOS build on a dev machine. RN's remainingnpm auditfindings are dev/test-tooling (jest/babel → brace-expansion chain) inherent to the RN 0.86 template and absent from the shipped mobile bundle.Related PRs (if applicable):
External related documentation (if applicable):
react-router, notreact-router-dom)🤖 Generated with Claude Code