From 071f3447fd4239438174d10b1f1d38181f408b8e Mon Sep 17 00:00:00 2001
From: Josh Knapp <jknapp85@gmail.com>
Date: Mon, 10 Aug 2026 08:37:42 -0700
Subject: [PATCH] Add static security advisory to HTML block style panel

Custom HTML block renders arbitrary markup on the published site.
Scripts and event handlers are stripped, but forms, iframes, and
images survive and can send data elsewhere. Add a plain, always-shown
advisory (no content detection) alongside the existing wrapper-styling
note.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 craft/src/panels/right/styles/HtmlStylePanel.test.tsx | 6 ++++++
 craft/src/panels/right/styles/HtmlStylePanel.tsx      | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/craft/src/panels/right/styles/HtmlStylePanel.test.tsx b/craft/src/panels/right/styles/HtmlStylePanel.test.tsx
index 891d2cd..f065fff 100644
--- a/craft/src/panels/right/styles/HtmlStylePanel.test.tsx
+++ b/craft/src/panels/right/styles/HtmlStylePanel.test.tsx
@@ -35,4 +35,10 @@ describe('HtmlStylePanel', () => {
     expect(container.textContent).not.toContain('Padding');
     expect(container.textContent).not.toContain('Border Radius');
   });
+
+  test('renders the security advisory', () => {
+    render(<HtmlStylePanel selectedId="n1" nodeProps={{ code: '<p>x</p>', style: {} }} />);
+    expect(container.textContent).toContain('Use this block with care.');
+    expect(container.textContent).toContain('Scripts and event handlers are stripped');
+  });
 });
diff --git a/craft/src/panels/right/styles/HtmlStylePanel.tsx b/craft/src/panels/right/styles/HtmlStylePanel.tsx
index 224435f..691857e 100644
--- a/craft/src/panels/right/styles/HtmlStylePanel.tsx
+++ b/craft/src/panels/right/styles/HtmlStylePanel.tsx
@@ -25,6 +25,13 @@ export const HtmlStylePanel: React.FC<{ selectedId: string; nodeProps: Record<st
         Style this block inside your own markup — a wrapper set here would show
         in the editor but not on the published page.
       </p>
+      <p style={{ fontSize: 10, color: 'var(--color-text-dim)', lineHeight: 1.4, padding: '0 2px' }}>
+        <strong>Use this block with care.</strong> It renders your markup as-is
+        on the published site. Scripts and event handlers are stripped
+        automatically, but anything that survives — forms, iframes, images —
+        can still send data to wherever it points. Only paste code you
+        understand or trust.
+      </p>
     </>
   );
 };