shadowdaoandClaude Opus 4.8 e5f30a4a56 Fix C1/C2: XSS via unsanitized style keys and animation attrs ...

C1: cssPropsToString emitted the camelToKebab'd style-object KEY
unsanitized while only sanitizing the VALUE. A malicious style key
containing a quote (reachable via AI update_props or deserialized
saved state) could close the style="..." attribute and inject a live
element. Now validates each key against a CSS property/custom-prop
allowlist and drops anything that doesn't match.

C2: buildDataAttrs (html-export.ts) interpolated props.animation and
props.animationDelay directly into data-animation="..."/
data-animation-delay="..." with no escaping, for every exported node.
Now routes both through escapeAttr.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-12 17:27:22 -07:00

..

a11y.test.ts

fix(builder): clickableProps must ignore keydown bubbled from nested controls

2026-07-12 14:58:13 -07:00

a11y.ts

fix(builder): clickableProps must ignore keydown bubbled from nested controls

2026-07-12 14:58:13 -07:00

apply-ai-response.test.ts

refactor(builder): type the AI-response/patch boundary

2026-07-12 15:30:56 -07:00

apply-ai-response.ts

refactor(builder): type the AI-response/patch boundary

2026-07-12 15:30:56 -07:00

assets.test.ts

feat(builder): shared asset upload/list util

2026-07-12 12:43:59 -07:00

assets.ts

feat(builder): shared asset upload/list util

2026-07-12 12:43:59 -07:00

canvas-summary.test.ts

sitesmith: canvas summary serializer with unit tests

2026-05-23 14:14:38 -07:00

canvas-summary.ts

sitesmith: canvas summary serializer with unit tests

2026-05-23 14:14:38 -07:00

clipboard.test.ts

ux: in-app confirm for asset/sitesmith delete + safe copy

2026-07-12 14:51:00 -07:00

clipboard.ts

ux: in-app confirm for asset/sitesmith delete + safe copy

2026-07-12 14:51:00 -07:00

craft-helpers.ts

fix(delete): redirect Delete to owning component when target is empty linked node

2026-04-26 20:42:17 -07:00

craft-tree.test.ts

refactor(builder): extract shared tree-flattener into craft-tree.ts

2026-07-12 14:04:43 -07:00

craft-tree.ts

refactor(builder): extract shared tree-flattener into craft-tree.ts

2026-07-12 14:04:43 -07:00

css-value.test.ts

fix(builder): sanitize CSS-value sinks to prevent style/<style> breakout XSS

2026-07-12 15:56:25 -07:00

escape.test.ts

thread node id through toHtml for deterministic+unique export ids

2026-07-12 14:34:53 -07:00

escape.ts

fix(builder): sanitize CSS-value sinks to prevent style/<style> breakout XSS

2026-07-12 15:56:25 -07:00

form-relay-wiring.test.ts

fix(builder): deterministic ids for NumberCounter + form-relay marker

2026-07-12 14:43:31 -07:00

form-relay-wiring.ts

fix(builder): deterministic ids for NumberCounter + form-relay marker

2026-07-12 14:43:31 -07:00

html-export.test.ts

Fix C1/C2: XSS via unsanitized style keys and animation attrs

2026-07-12 17:27:22 -07:00

html-export.ts

Fix C1/C2: XSS via unsanitized style keys and animation attrs

2026-07-12 17:27:22 -07:00

sitesmith-target.ts

site-builder: dynamic CTAs, section anchors, edit-with-Sitesmith

2026-05-25 12:43:28 -07:00

style-helpers.test.ts

Fix C1/C2: XSS via unsanitized style keys and animation attrs

2026-07-12 17:27:22 -07:00

style-helpers.ts

Fix C1/C2: XSS via unsanitized style keys and animation attrs

2026-07-12 17:27:22 -07:00