cards-testimonial.js security and complexity fixes, also fixed white stars by helms-charity · Pull Request #678 · aemsites/idfc

helms-charity · 2026-02-21T21:59:49Z

added sanitizeHTML to prevent XSS
added a few helper functions to reduce the complexity and nesting of the existing functions [1]
Fixed the fact that the white stars weren't showing for inactive cards too
While Sonarlint prefers "dataset" instead of "setAttribute", there were places that it broke things so I left about 8 of them as they were.

Test URLs:

Before: https://main--idfc--aemsites.aem.page/
After: https://677-testimonialjs--idfc--aemsites.aem.page/

Testing: THere should be no changes from Main except the white stars now show for grey cards.

[1
Summary of changes that keep decorate at no more than 4 levels of nesting:
New helpers (each with its own, limited nesting):
buildCardsFromRows(rows) – Builds the cards container from block rows (row loop + child loop and class assignment). Replaces the previous double forEach inside decorate.
optimizePicturesInContainer(cardsContainer) – Handles the picture > img optimization and dataset copy. Replaces the inner picture forEach in decorate.
copyBlockPropertiesFromContext(block) – Copies swipable, autoplayEnabled, and startingCard from section/block-content to the block. Replaces the [blockContent, section].forEach(...) block in decorate.
setImageDimensionsFromRects(block) – Sets dataset width/height from getBoundingClientRect() for images that don’t have them. Used inside requestAnimationFrame so the frame callback stays at one level: requestAnimationFrame(() => setImageDimensionsFromRects(block)) (3 levels total).
waitForSwiperLib() – Returns the Promise that waits for Swiper (with setInterval/setTimeout). The Swiper-wait logic is no longer nested inside decorate.
updateStarIconInSlide(slide, activeSlide) – Updates star icons for a single slide. The previous updateStarIcons had requestAnimationFrame → slides.forEach → inner forEach (6 levels). Now updateStarIcons only does requestAnimationFrame → slides.forEach((slide) => updateStarIconInSlide(slide, activeSlide)) (4 levels), and the per-slide work lives in updateStarIconInSlide (max 3 levels).
decorate now:
Calls these helpers instead of inlining their logic.
Keeps nesting at at most 4 levels (e.g. decorate → if (!isSwipable) → requestAnimationFrame → callback; or decorate → updateStarIcons → requestAnimationFrame → slides.forEach).

aem-code-sync · 2026-02-21T21:59:52Z

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
In case there are problems, just click a checkbox below to rerun the respective action.