4c001e1af42e2faf9faca4cc439eb1998424c580
sanitizeCssValue's blanket `;` strip ran on the whole value AFTER url(...) content was already safely re-wrapped, corrupting legitimate data:image/png;base64,... URLs pasted into Background Image fields (the MIME/base64 separator `;` was deleted, breaking the data URI in exported/published HTML). Scope the `;`/`"` breakout sanitization to the segments outside url(...) matches only -- the url() branch is already fully safe via escapeAttr(safeUrl(...)) and must not be re-stripped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Description
Visual drag-and-drop website builder using GrapesJS
Languages
TypeScript
61.2%
HTML
17.1%
JavaScript
17%
CSS
3.6%
PHP
0.8%
Other
0.3%