shadowdaoandClaude Opus 5.5
41d0721028
The capture never fetches external images, so placehold.co placeholders came out as a blank grey box (Chromium) or alt text (Firefox) and the reviewer reported a false "screenshot mismatch". checkUrl now maps a strictly parsed placehold.co URL (https, host exactly placehold.co, /WxH with 1-4 digits, up to two 3/6-digit hex colours, optional image extension) to a locally generated SVG data URL of the same intrinsic size: URL bg colour (default #cccccc), ?text= label (default "W x H") in the fg colour (default #969696), XML-escaped. Off-spec placehold.co URLs become a plain #cccccc box (no label), or the old 1x1 grey image when the size is unknown. Works for <img> (own CSS: width, aspect-ratio, object-fit) and CSS url() backgrounds. Only an SVG byte-identical to our generator passes the second sanitiser pass. makePolicy/allow-list, sandbox and CSP unchanged; fetchBounded refuses placehold.co outright. e2e: fidelity samples the boxes/labels, security asserts zero placehold.co requests (incl. hostile ?text=) in Chromium and Firefox. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
