FOUR-29250 End Event – External URL with Mustache Support - #1963

Merged
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250
Mar 13, 2026
Merged

FOUR-29250 End Event – External URL with Mustache Support#1963
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250

Conversation

@gproly

@gprolygproly commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description:
feat(end event): support Mustache in external URL for element destination

  • Resolve Mustache expressions in end event "External URL" when the token reaches the end event, using the same context as scripts/screens (APP_URL, _request, _user, process variables).
  • Add getElementDestinationMustacheContext() to build context via DataManager with fallback; normalize to plain array for Mustache.
  • Add resolveElementDestinationUrl() to decode HTML entities and render URL template with MustacheExpressionEvaluator. FEEL is not supported.
  • Apply resolution only for externalURL type; conditional redirect URLs also go through Mustache when destination is external URL.
  • Harden getElementDestinationAttribute(): ensure conditionalRedirectProp and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
  • Modeler: allow URL validation when string contains {{ (Mustache); update helper and error copy to document _request.id, _user.id, process vars.

Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250


Note

Low Risk
UI-only validation and copy changes plus a new pure utility with unit tests; no runtime redirect/execution logic is modified.

Overview
Adds shared URL validation for External URL destinations that accepts either a standard URL or a Mustache-templated URL (e.g. {{APP_URL}}, {{_request.id}}, {{_user.id}}, and process variables), and updates helper/error copy to document the supported placeholders.

Both ElementDestination and Conditional Redirect Task Destination now use the new isValidElementDestinationURL utility (with stricter “required only when selected” behavior) and include unit tests covering Mustache parsing edge cases and URL-skeleton validation.

Written by Cursor Bugbot for commit c1374e6. This will update automatically on new commits. Configure here.

Description:
feat(end event): support Mustache in external URL for element destination
- Resolve Mustache expressions in end event "External URL" when the token
reaches the end event, using the same context as scripts/screens
(APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
@cypress

cypressBot commented Feb 10, 2026

Copy link
Copy Markdown

modelerRun #1783

Run Properties:status check passed Passed #1783git commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
Projectmodeler
Branch Reviewfeature/FOUR-29250
Run statusstatus check passed Passed #1783
Run duration06m 00s
Commitgit commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
CommitterRoly Rudy Gutierrez Pinto
View all properties for this run ↗︎

Test results
Tests that failedFailures0
Tests that were flakyFlaky0
Tests that did not run due to a developer annotating a test with .skipPending83
Tests that did not run due to a failure in a mocha hookSkipped0
Tests that passedPassing310
View all changes introduced in this branch ↗︎

…pector to display element configuration data (formData) as key-value pairs with keyboard-accessible toggle.
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
…he examples outside $t() so {{APP_URL}}, {{_request.id}}, {{_user.id}} display correctly.
@pmPaulispmPaulis changed the title FOUR-29250 End Event – External URL with Mustache/FEEL SupportFOUR-29250 End Event – External URL with Mustache SupportFeb 17, 2026
…ination components
- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
…ement Destination URLs
- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
Comment threadsrc/utils/elementDestinationUrl.js
Comment threadsrc/utils/elementDestinationUrl.js Outdated
… utility
- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
Comment threadsrc/utils/elementDestinationUrl.js
- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadsrc/utils/elementDestinationUrl.js
@processmaker-sonarqube

Copy link
Copy Markdown

@nolanpro
nolanpro merged commit fae47dd into developMar 13, 2026
39 of 43 checks passed
@nolanpro
nolanpro deleted the feature/FOUR-29250 branch March 13, 2026 19:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gproly@rodriquelca@nolanpro@pmPaulis
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

FOUR-29250 End Event – External URL with Mustache Support - #1963

Merged
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250
Mar 13, 2026
Merged

FOUR-29250 End Event – External URL with Mustache Support#1963
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250

Conversation

@gproly

@gprolygproly commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description:
feat(end event): support Mustache in external URL for element destination

  • Resolve Mustache expressions in end event "External URL" when the token reaches the end event, using the same context as scripts/screens (APP_URL, _request, _user, process variables).
  • Add getElementDestinationMustacheContext() to build context via DataManager with fallback; normalize to plain array for Mustache.
  • Add resolveElementDestinationUrl() to decode HTML entities and render URL template with MustacheExpressionEvaluator. FEEL is not supported.
  • Apply resolution only for externalURL type; conditional redirect URLs also go through Mustache when destination is external URL.
  • Harden getElementDestinationAttribute(): ensure conditionalRedirectProp and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
  • Modeler: allow URL validation when string contains {{ (Mustache); update helper and error copy to document _request.id, _user.id, process vars.

Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250


Note

Low Risk
UI-only validation and copy changes plus a new pure utility with unit tests; no runtime redirect/execution logic is modified.

Overview
Adds shared URL validation for External URL destinations that accepts either a standard URL or a Mustache-templated URL (e.g. {{APP_URL}}, {{_request.id}}, {{_user.id}}, and process variables), and updates helper/error copy to document the supported placeholders.

Both ElementDestination and Conditional Redirect Task Destination now use the new isValidElementDestinationURL utility (with stricter “required only when selected” behavior) and include unit tests covering Mustache parsing edge cases and URL-skeleton validation.

Written by Cursor Bugbot for commit c1374e6. This will update automatically on new commits. Configure here.

Description:
feat(end event): support Mustache in external URL for element destination
- Resolve Mustache expressions in end event "External URL" when the token
reaches the end event, using the same context as scripts/screens
(APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
@cypress

cypressBot commented Feb 10, 2026

Copy link
Copy Markdown

modelerRun #1783

Run Properties:status check passed Passed #1783git commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
Projectmodeler
Branch Reviewfeature/FOUR-29250
Run statusstatus check passed Passed #1783
Run duration06m 00s
Commitgit commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
CommitterRoly Rudy Gutierrez Pinto
View all properties for this run ↗︎

Test results
Tests that failedFailures0
Tests that were flakyFlaky0
Tests that did not run due to a developer annotating a test with .skipPending83
Tests that did not run due to a failure in a mocha hookSkipped0
Tests that passedPassing310
View all changes introduced in this branch ↗︎

…pector to display element configuration data (formData) as key-value pairs with keyboard-accessible toggle.
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
…he examples outside $t() so {{APP_URL}}, {{_request.id}}, {{_user.id}} display correctly.
@pmPaulispmPaulis changed the title FOUR-29250 End Event – External URL with Mustache/FEEL SupportFOUR-29250 End Event – External URL with Mustache SupportFeb 17, 2026
…ination components
- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
…ement Destination URLs
- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
Comment threadsrc/utils/elementDestinationUrl.js
Comment threadsrc/utils/elementDestinationUrl.js Outdated
… utility
- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
Comment threadsrc/utils/elementDestinationUrl.js
- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadsrc/utils/elementDestinationUrl.js
@processmaker-sonarqube

Copy link
Copy Markdown

@nolanpro
nolanpro merged commit fae47dd into developMar 13, 2026
39 of 43 checks passed
@nolanpro
nolanpro deleted the feature/FOUR-29250 branch March 13, 2026 19:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gproly@rodriquelca@nolanpro@pmPaulis
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

FOUR-29250 End Event – External URL with Mustache Support - #1963

Merged
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250
Mar 13, 2026
Merged

FOUR-29250 End Event – External URL with Mustache Support#1963
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250

Conversation

@gproly

@gprolygproly commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description:
feat(end event): support Mustache in external URL for element destination

  • Resolve Mustache expressions in end event "External URL" when the token reaches the end event, using the same context as scripts/screens (APP_URL, _request, _user, process variables).
  • Add getElementDestinationMustacheContext() to build context via DataManager with fallback; normalize to plain array for Mustache.
  • Add resolveElementDestinationUrl() to decode HTML entities and render URL template with MustacheExpressionEvaluator. FEEL is not supported.
  • Apply resolution only for externalURL type; conditional redirect URLs also go through Mustache when destination is external URL.
  • Harden getElementDestinationAttribute(): ensure conditionalRedirectProp and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
  • Modeler: allow URL validation when string contains {{ (Mustache); update helper and error copy to document _request.id, _user.id, process vars.

Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250


Note

Low Risk
UI-only validation and copy changes plus a new pure utility with unit tests; no runtime redirect/execution logic is modified.

Overview
Adds shared URL validation for External URL destinations that accepts either a standard URL or a Mustache-templated URL (e.g. {{APP_URL}}, {{_request.id}}, {{_user.id}}, and process variables), and updates helper/error copy to document the supported placeholders.

Both ElementDestination and Conditional Redirect Task Destination now use the new isValidElementDestinationURL utility (with stricter “required only when selected” behavior) and include unit tests covering Mustache parsing edge cases and URL-skeleton validation.

Written by Cursor Bugbot for commit c1374e6. This will update automatically on new commits. Configure here.

Description:
feat(end event): support Mustache in external URL for element destination
- Resolve Mustache expressions in end event "External URL" when the token
reaches the end event, using the same context as scripts/screens
(APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
@cypress

cypressBot commented Feb 10, 2026

Copy link
Copy Markdown

modelerRun #1783

Run Properties:status check passed Passed #1783git commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
Projectmodeler
Branch Reviewfeature/FOUR-29250
Run statusstatus check passed Passed #1783
Run duration06m 00s
Commitgit commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
CommitterRoly Rudy Gutierrez Pinto
View all properties for this run ↗︎

Test results
Tests that failedFailures0
Tests that were flakyFlaky0
Tests that did not run due to a developer annotating a test with .skipPending83
Tests that did not run due to a failure in a mocha hookSkipped0
Tests that passedPassing310
View all changes introduced in this branch ↗︎

…pector to display element configuration data (formData) as key-value pairs with keyboard-accessible toggle.
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
…he examples outside $t() so {{APP_URL}}, {{_request.id}}, {{_user.id}} display correctly.
@pmPaulispmPaulis changed the title FOUR-29250 End Event – External URL with Mustache/FEEL SupportFOUR-29250 End Event – External URL with Mustache SupportFeb 17, 2026
…ination components
- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
…ement Destination URLs
- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
Comment threadsrc/utils/elementDestinationUrl.js
Comment threadsrc/utils/elementDestinationUrl.js Outdated
… utility
- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
Comment threadsrc/utils/elementDestinationUrl.js
- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadsrc/utils/elementDestinationUrl.js
@processmaker-sonarqube

Copy link
Copy Markdown

@nolanpro
nolanpro merged commit fae47dd into developMar 13, 2026
39 of 43 checks passed
@nolanpro
nolanpro deleted the feature/FOUR-29250 branch March 13, 2026 19:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gproly@rodriquelca@nolanpro@pmPaulis
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

FOUR-29250 End Event – External URL with Mustache Support - #1963

Merged
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250
Mar 13, 2026
Merged

FOUR-29250 End Event – External URL with Mustache Support#1963
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250

Conversation

@gproly

@gprolygproly commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description:
feat(end event): support Mustache in external URL for element destination

  • Resolve Mustache expressions in end event "External URL" when the token reaches the end event, using the same context as scripts/screens (APP_URL, _request, _user, process variables).
  • Add getElementDestinationMustacheContext() to build context via DataManager with fallback; normalize to plain array for Mustache.
  • Add resolveElementDestinationUrl() to decode HTML entities and render URL template with MustacheExpressionEvaluator. FEEL is not supported.
  • Apply resolution only for externalURL type; conditional redirect URLs also go through Mustache when destination is external URL.
  • Harden getElementDestinationAttribute(): ensure conditionalRedirectProp and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
  • Modeler: allow URL validation when string contains {{ (Mustache); update helper and error copy to document _request.id, _user.id, process vars.

Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250


Note

Low Risk
UI-only validation and copy changes plus a new pure utility with unit tests; no runtime redirect/execution logic is modified.

Overview
Adds shared URL validation for External URL destinations that accepts either a standard URL or a Mustache-templated URL (e.g. {{APP_URL}}, {{_request.id}}, {{_user.id}}, and process variables), and updates helper/error copy to document the supported placeholders.

Both ElementDestination and Conditional Redirect Task Destination now use the new isValidElementDestinationURL utility (with stricter “required only when selected” behavior) and include unit tests covering Mustache parsing edge cases and URL-skeleton validation.

Written by Cursor Bugbot for commit c1374e6. This will update automatically on new commits. Configure here.

Description:
feat(end event): support Mustache in external URL for element destination
- Resolve Mustache expressions in end event "External URL" when the token
reaches the end event, using the same context as scripts/screens
(APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
@cypress

cypressBot commented Feb 10, 2026

Copy link
Copy Markdown

modelerRun #1783

Run Properties:status check passed Passed #1783git commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
Projectmodeler
Branch Reviewfeature/FOUR-29250
Run statusstatus check passed Passed #1783
Run duration06m 00s
Commitgit commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
CommitterRoly Rudy Gutierrez Pinto
View all properties for this run ↗︎

Test results
Tests that failedFailures0
Tests that were flakyFlaky0
Tests that did not run due to a developer annotating a test with .skipPending83
Tests that did not run due to a failure in a mocha hookSkipped0
Tests that passedPassing310
View all changes introduced in this branch ↗︎

…pector to display element configuration data (formData) as key-value pairs with keyboard-accessible toggle.
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
…he examples outside $t() so {{APP_URL}}, {{_request.id}}, {{_user.id}} display correctly.
@pmPaulispmPaulis changed the title FOUR-29250 End Event – External URL with Mustache/FEEL SupportFOUR-29250 End Event – External URL with Mustache SupportFeb 17, 2026
…ination components
- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
…ement Destination URLs
- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
Comment threadsrc/utils/elementDestinationUrl.js
Comment threadsrc/utils/elementDestinationUrl.js Outdated
… utility
- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
Comment threadsrc/utils/elementDestinationUrl.js
- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadsrc/utils/elementDestinationUrl.js
@processmaker-sonarqube

Copy link
Copy Markdown

@nolanpro
nolanpro merged commit fae47dd into developMar 13, 2026
39 of 43 checks passed
@nolanpro
nolanpro deleted the feature/FOUR-29250 branch March 13, 2026 19:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gproly@rodriquelca@nolanpro@pmPaulis
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

FOUR-29250 End Event – External URL with Mustache Support - #1963

Merged
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250
Mar 13, 2026
Merged

FOUR-29250 End Event – External URL with Mustache Support#1963
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250

Conversation

@gproly

@gprolygproly commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description:
feat(end event): support Mustache in external URL for element destination

  • Resolve Mustache expressions in end event "External URL" when the token reaches the end event, using the same context as scripts/screens (APP_URL, _request, _user, process variables).
  • Add getElementDestinationMustacheContext() to build context via DataManager with fallback; normalize to plain array for Mustache.
  • Add resolveElementDestinationUrl() to decode HTML entities and render URL template with MustacheExpressionEvaluator. FEEL is not supported.
  • Apply resolution only for externalURL type; conditional redirect URLs also go through Mustache when destination is external URL.
  • Harden getElementDestinationAttribute(): ensure conditionalRedirectProp and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
  • Modeler: allow URL validation when string contains {{ (Mustache); update helper and error copy to document _request.id, _user.id, process vars.

Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250


Note

Low Risk
UI-only validation and copy changes plus a new pure utility with unit tests; no runtime redirect/execution logic is modified.

Overview
Adds shared URL validation for External URL destinations that accepts either a standard URL or a Mustache-templated URL (e.g. {{APP_URL}}, {{_request.id}}, {{_user.id}}, and process variables), and updates helper/error copy to document the supported placeholders.

Both ElementDestination and Conditional Redirect Task Destination now use the new isValidElementDestinationURL utility (with stricter “required only when selected” behavior) and include unit tests covering Mustache parsing edge cases and URL-skeleton validation.

Written by Cursor Bugbot for commit c1374e6. This will update automatically on new commits. Configure here.

Description:
feat(end event): support Mustache in external URL for element destination
- Resolve Mustache expressions in end event "External URL" when the token
reaches the end event, using the same context as scripts/screens
(APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
@cypress

cypressBot commented Feb 10, 2026

Copy link
Copy Markdown

modelerRun #1783

Run Properties:status check passed Passed #1783git commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
Projectmodeler
Branch Reviewfeature/FOUR-29250
Run statusstatus check passed Passed #1783
Run duration06m 00s
Commitgit commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
CommitterRoly Rudy Gutierrez Pinto
View all properties for this run ↗︎

Test results
Tests that failedFailures0
Tests that were flakyFlaky0
Tests that did not run due to a developer annotating a test with .skipPending83
Tests that did not run due to a failure in a mocha hookSkipped0
Tests that passedPassing310
View all changes introduced in this branch ↗︎

…pector to display element configuration data (formData) as key-value pairs with keyboard-accessible toggle.
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
…he examples outside $t() so {{APP_URL}}, {{_request.id}}, {{_user.id}} display correctly.
@pmPaulispmPaulis changed the title FOUR-29250 End Event – External URL with Mustache/FEEL SupportFOUR-29250 End Event – External URL with Mustache SupportFeb 17, 2026
…ination components
- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
…ement Destination URLs
- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
Comment threadsrc/utils/elementDestinationUrl.js
Comment threadsrc/utils/elementDestinationUrl.js Outdated
… utility
- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
Comment threadsrc/utils/elementDestinationUrl.js
- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadsrc/utils/elementDestinationUrl.js
@processmaker-sonarqube

Copy link
Copy Markdown

@nolanpro
nolanpro merged commit fae47dd into developMar 13, 2026
39 of 43 checks passed
@nolanpro
nolanpro deleted the feature/FOUR-29250 branch March 13, 2026 19:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gproly@rodriquelca@nolanpro@pmPaulis
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

FOUR-29250 End Event – External URL with Mustache Support - #1963

Merged
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250
Mar 13, 2026
Merged

FOUR-29250 End Event – External URL with Mustache Support#1963
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250

Conversation

@gproly

@gprolygproly commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description:
feat(end event): support Mustache in external URL for element destination

  • Resolve Mustache expressions in end event "External URL" when the token reaches the end event, using the same context as scripts/screens (APP_URL, _request, _user, process variables).
  • Add getElementDestinationMustacheContext() to build context via DataManager with fallback; normalize to plain array for Mustache.
  • Add resolveElementDestinationUrl() to decode HTML entities and render URL template with MustacheExpressionEvaluator. FEEL is not supported.
  • Apply resolution only for externalURL type; conditional redirect URLs also go through Mustache when destination is external URL.
  • Harden getElementDestinationAttribute(): ensure conditionalRedirectProp and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
  • Modeler: allow URL validation when string contains {{ (Mustache); update helper and error copy to document _request.id, _user.id, process vars.

Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250


Note

Low Risk
UI-only validation and copy changes plus a new pure utility with unit tests; no runtime redirect/execution logic is modified.

Overview
Adds shared URL validation for External URL destinations that accepts either a standard URL or a Mustache-templated URL (e.g. {{APP_URL}}, {{_request.id}}, {{_user.id}}, and process variables), and updates helper/error copy to document the supported placeholders.

Both ElementDestination and Conditional Redirect Task Destination now use the new isValidElementDestinationURL utility (with stricter “required only when selected” behavior) and include unit tests covering Mustache parsing edge cases and URL-skeleton validation.

Written by Cursor Bugbot for commit c1374e6. This will update automatically on new commits. Configure here.

Description:
feat(end event): support Mustache in external URL for element destination
- Resolve Mustache expressions in end event "External URL" when the token
reaches the end event, using the same context as scripts/screens
(APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
@cypress

cypressBot commented Feb 10, 2026

Copy link
Copy Markdown

modelerRun #1783

Run Properties:status check passed Passed #1783git commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
Projectmodeler
Branch Reviewfeature/FOUR-29250
Run statusstatus check passed Passed #1783
Run duration06m 00s
Commitgit commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
CommitterRoly Rudy Gutierrez Pinto
View all properties for this run ↗︎

Test results
Tests that failedFailures0
Tests that were flakyFlaky0
Tests that did not run due to a developer annotating a test with .skipPending83
Tests that did not run due to a failure in a mocha hookSkipped0
Tests that passedPassing310
View all changes introduced in this branch ↗︎

…pector to display element configuration data (formData) as key-value pairs with keyboard-accessible toggle.
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
…he examples outside $t() so {{APP_URL}}, {{_request.id}}, {{_user.id}} display correctly.
@pmPaulispmPaulis changed the title FOUR-29250 End Event – External URL with Mustache/FEEL SupportFOUR-29250 End Event – External URL with Mustache SupportFeb 17, 2026
…ination components
- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
…ement Destination URLs
- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
Comment threadsrc/utils/elementDestinationUrl.js
Comment threadsrc/utils/elementDestinationUrl.js Outdated
… utility
- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
Comment threadsrc/utils/elementDestinationUrl.js
- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadsrc/utils/elementDestinationUrl.js
@processmaker-sonarqube

Copy link
Copy Markdown

@nolanpro
nolanpro merged commit fae47dd into developMar 13, 2026
39 of 43 checks passed
@nolanpro
nolanpro deleted the feature/FOUR-29250 branch March 13, 2026 19:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gproly@rodriquelca@nolanpro@pmPaulis
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

FOUR-29250 End Event – External URL with Mustache Support - #1963

Merged
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250
Mar 13, 2026
Merged

FOUR-29250 End Event – External URL with Mustache Support#1963
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250

Conversation

@gproly

@gprolygproly commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description:
feat(end event): support Mustache in external URL for element destination

  • Resolve Mustache expressions in end event "External URL" when the token reaches the end event, using the same context as scripts/screens (APP_URL, _request, _user, process variables).
  • Add getElementDestinationMustacheContext() to build context via DataManager with fallback; normalize to plain array for Mustache.
  • Add resolveElementDestinationUrl() to decode HTML entities and render URL template with MustacheExpressionEvaluator. FEEL is not supported.
  • Apply resolution only for externalURL type; conditional redirect URLs also go through Mustache when destination is external URL.
  • Harden getElementDestinationAttribute(): ensure conditionalRedirectProp and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
  • Modeler: allow URL validation when string contains {{ (Mustache); update helper and error copy to document _request.id, _user.id, process vars.

Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250


Note

Low Risk
UI-only validation and copy changes plus a new pure utility with unit tests; no runtime redirect/execution logic is modified.

Overview
Adds shared URL validation for External URL destinations that accepts either a standard URL or a Mustache-templated URL (e.g. {{APP_URL}}, {{_request.id}}, {{_user.id}}, and process variables), and updates helper/error copy to document the supported placeholders.

Both ElementDestination and Conditional Redirect Task Destination now use the new isValidElementDestinationURL utility (with stricter “required only when selected” behavior) and include unit tests covering Mustache parsing edge cases and URL-skeleton validation.

Written by Cursor Bugbot for commit c1374e6. This will update automatically on new commits. Configure here.

Description:
feat(end event): support Mustache in external URL for element destination
- Resolve Mustache expressions in end event "External URL" when the token
reaches the end event, using the same context as scripts/screens
(APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
@cypress

cypressBot commented Feb 10, 2026

Copy link
Copy Markdown

modelerRun #1783

Run Properties:status check passed Passed #1783git commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
Projectmodeler
Branch Reviewfeature/FOUR-29250
Run statusstatus check passed Passed #1783
Run duration06m 00s
Commitgit commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
CommitterRoly Rudy Gutierrez Pinto
View all properties for this run ↗︎

Test results
Tests that failedFailures0
Tests that were flakyFlaky0
Tests that did not run due to a developer annotating a test with .skipPending83
Tests that did not run due to a failure in a mocha hookSkipped0
Tests that passedPassing310
View all changes introduced in this branch ↗︎

…pector to display element configuration data (formData) as key-value pairs with keyboard-accessible toggle.
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
…he examples outside $t() so {{APP_URL}}, {{_request.id}}, {{_user.id}} display correctly.
@pmPaulispmPaulis changed the title FOUR-29250 End Event – External URL with Mustache/FEEL SupportFOUR-29250 End Event – External URL with Mustache SupportFeb 17, 2026
…ination components
- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
…ement Destination URLs
- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
Comment threadsrc/utils/elementDestinationUrl.js
Comment threadsrc/utils/elementDestinationUrl.js Outdated
… utility
- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
Comment threadsrc/utils/elementDestinationUrl.js
- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadsrc/utils/elementDestinationUrl.js
@processmaker-sonarqube

Copy link
Copy Markdown

@nolanpro
nolanpro merged commit fae47dd into developMar 13, 2026
39 of 43 checks passed
@nolanpro
nolanpro deleted the feature/FOUR-29250 branch March 13, 2026 19:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gproly@rodriquelca@nolanpro@pmPaulis
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

FOUR-29250 End Event – External URL with Mustache Support - #1963

Merged
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250
Mar 13, 2026
Merged

FOUR-29250 End Event – External URL with Mustache Support#1963
nolanpro merged 16 commits into
developfrom
feature/FOUR-29250

Conversation

@gproly

@gprolygproly commented Feb 10, 2026

Copy link
Copy Markdown
Contributor

Description:
feat(end event): support Mustache in external URL for element destination

  • Resolve Mustache expressions in end event "External URL" when the token reaches the end event, using the same context as scripts/screens (APP_URL, _request, _user, process variables).
  • Add getElementDestinationMustacheContext() to build context via DataManager with fallback; normalize to plain array for Mustache.
  • Add resolveElementDestinationUrl() to decode HTML entities and render URL template with MustacheExpressionEvaluator. FEEL is not supported.
  • Apply resolution only for externalURL type; conditional redirect URLs also go through Mustache when destination is external URL.
  • Harden getElementDestinationAttribute(): ensure conditionalRedirectProp and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
  • Modeler: allow URL validation when string contains {{ (Mustache); update helper and error copy to document _request.id, _user.id, process vars.

Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250


Note

Low Risk
UI-only validation and copy changes plus a new pure utility with unit tests; no runtime redirect/execution logic is modified.

Overview
Adds shared URL validation for External URL destinations that accepts either a standard URL or a Mustache-templated URL (e.g. {{APP_URL}}, {{_request.id}}, {{_user.id}}, and process variables), and updates helper/error copy to document the supported placeholders.

Both ElementDestination and Conditional Redirect Task Destination now use the new isValidElementDestinationURL utility (with stricter “required only when selected” behavior) and include unit tests covering Mustache parsing edge cases and URL-skeleton validation.

Written by Cursor Bugbot for commit c1374e6. This will update automatically on new commits. Configure here.

Description:
feat(end event): support Mustache in external URL for element destination
- Resolve Mustache expressions in end event "External URL" when the token
reaches the end event, using the same context as scripts/screens
(APP_URL, _request, _user, process variables).
- Add getElementDestinationMustacheContext() to build context via DataManager
with fallback; normalize to plain array for Mustache.
- Add resolveElementDestinationUrl() to decode HTML entities and render
URL template with MustacheExpressionEvaluator. FEEL is not supported.
- Apply resolution only for externalURL type; conditional redirect URLs
also go through Mustache when destination is external URL.
- Harden getElementDestinationAttribute(): ensure conditionalRedirectProp
and elementDestinationProp are never null (json_decode ?? [], pass ?? []).
- Modeler: allow URL validation when string contains {{ (Mustache); update
helper and error copy to document _request.id, _user.id, process vars.
Related tickets:
https://processmaker.atlassian.net/browse/FOUR-29250
@cypress

cypressBot commented Feb 10, 2026

Copy link
Copy Markdown

modelerRun #1783

Run Properties:status check passed Passed #1783git commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
Projectmodeler
Branch Reviewfeature/FOUR-29250
Run statusstatus check passed Passed #1783
Run duration06m 00s
Commitgit commit0a66297260: FOUR-29250 End Event – External URL with Mustache Support
CommitterRoly Rudy Gutierrez Pinto
View all properties for this run ↗︎

Test results
Tests that failedFailures0
Tests that were flakyFlaky0
Tests that did not run due to a developer annotating a test with .skipPending83
Tests that did not run due to a failure in a mocha hookSkipped0
Tests that passedPassing310
View all changes introduced in this branch ↗︎

…pector to display element configuration data (formData) as key-value pairs with keyboard-accessible toggle.
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
Comment threadsrc/components/inspectors/ElementDestination.vue Outdated
- Treat non-strings and empty/whitespace as invalid in isValidURL; use type-safe isEmpty in getValidationErrorForURL
- Accept Mustache only when full {{ ... }} pattern matches (reject "{{", "{{invalid", etc.)
…he examples outside $t() so {{APP_URL}}, {{_request.id}}, {{_user.id}} display correctly.
@pmPaulispmPaulis changed the title FOUR-29250 End Event – External URL with Mustache/FEEL SupportFOUR-29250 End Event – External URL with Mustache SupportFeb 17, 2026
…ination components
- Consolidate URL validation logic by utilizing isValidElementDestinationURL utility.
- Update error messages for URL validation to improve clarity and user guidance.
- Enhance helper text for external URL input to include Mustache expression support.
…ement Destination URLs
- Introduce a new utility function to validate Element Destination and Conditional Redirect URLs.
- Implement checks for valid Mustache placeholders and valid URL formats.
- Ensure the function handles non-string and empty inputs appropriately.
Comment threadsrc/utils/elementDestinationUrl.js
Comment threadsrc/utils/elementDestinationUrl.js Outdated
… utility
- Refine the regex for valid Mustache placeholders to exclude '}' characters, enhancing validation accuracy.
- Add a note regarding the use of [^\s}]+ to prevent ReDoS from backtracking, improving performance and security.
Comment threadsrc/utils/elementDestinationUrl.js
- Add EMPTY_MUSTACHE check in hasValidMustacheOnly to reject {{}} and {{ }}
- Add unit tests for empty mustache and mixed valid + empty placeholder case
- Reject stray {/} and invalid URL literals in hasValidMustacheOnly
- Simplify validation and unify comments in elementDestinationUrl.js
- Add tests for URL skeleton, stray braces, and invalid literals

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.

Comment threadsrc/utils/elementDestinationUrl.js
@processmaker-sonarqube

Copy link
Copy Markdown

@nolanpro
nolanpro merged commit fae47dd into developMar 13, 2026
39 of 43 checks passed
@nolanpro
nolanpro deleted the feature/FOUR-29250 branch March 13, 2026 19:03
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@gproly@rodriquelca@nolanpro@pmPaulis