shadowdao 4c001e1af4 fix(builder): preserve data-URI semicolons in css value sanitizer
sanitizeCssValue's blanket `;` strip ran on the whole value AFTER url(...)
content was already safely re-wrapped, corrupting legitimate
data:image/png;base64,... URLs pasted into Background Image fields
(the MIME/base64 separator `;` was deleted, breaking the data URI in
exported/published HTML). Scope the `;`/`"` breakout sanitization to the
segments outside url(...) matches only -- the url() branch is already
fully safe via escapeAttr(safeUrl(...)) and must not be re-stripped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 12:15:23 -07:00
S
Description
Visual drag-and-drop website builder using GrapesJS
3.1 MiB
Languages
TypeScript 61.2%
HTML 17.1%
JavaScript 17%
CSS 3.6%
PHP 0.8%
Other 0.3%