shadowdao 621bb21d52 fix(builder): safeImageUrl for FeaturesGrid/ContentSlider image sinks + tighten data:image allowlist ...

FeaturesGrid's <img src> and ContentSlider's CSS background-image url()
were still on safeUrl, which blocks data:image/svg+xml -- inconsistent
with other image sinks already swapped to safeImageUrl and a latent
regression for those two components. Swapped both to safeImageUrl;
left their navigation sinks (buttonUrl/buttonHref) on safeUrl.

Also tightened safeImageUrl's data:image allowlist check to require the
slash (dataimage/ not dataimage), so a bogus MIME like
data:imagehtml/... can no longer slip past the prefix check.

2026-07-12 19:53:02 -07:00

..

a11y.test.ts

fix(builder): clickableProps must ignore keydown bubbled from nested controls

2026-07-12 14:58:13 -07:00

a11y.ts

fix(builder): clickableProps must ignore keydown bubbled from nested controls

2026-07-12 14:58:13 -07:00

apply-ai-response.test.ts

refactor(builder): type the AI-response/patch boundary

2026-07-12 15:30:56 -07:00

apply-ai-response.ts

refactor(builder): type the AI-response/patch boundary

2026-07-12 15:30:56 -07:00

assets.test.ts

feat(builder): shared asset upload/list util

2026-07-12 12:43:59 -07:00

assets.ts

feat(builder): shared asset upload/list util

2026-07-12 12:43:59 -07:00

canvas-summary.test.ts

sitesmith: canvas summary serializer with unit tests

2026-05-23 14:14:38 -07:00

canvas-summary.ts

sitesmith: canvas summary serializer with unit tests

2026-05-23 14:14:38 -07:00

clipboard.test.ts

ux: in-app confirm for asset/sitesmith delete + safe copy

2026-07-12 14:51:00 -07:00

clipboard.ts

ux: in-app confirm for asset/sitesmith delete + safe copy

2026-07-12 14:51:00 -07:00

craft-helpers.ts

fix(delete): redirect Delete to owning component when target is empty linked node

2026-04-26 20:42:17 -07:00

craft-tree.test.ts

refactor(builder): extract shared tree-flattener into craft-tree.ts

2026-07-12 14:04:43 -07:00

craft-tree.ts

refactor(builder): extract shared tree-flattener into craft-tree.ts

2026-07-12 14:04:43 -07:00

css-value.test.ts

fix(builder): sanitize CSS-value sinks to prevent style/<style> breakout XSS

2026-07-12 15:56:25 -07:00

escape.test.ts

fix(builder): safeImageUrl for FeaturesGrid/ContentSlider image sinks + tighten data:image allowlist

2026-07-12 19:53:02 -07:00

escape.ts

fix(builder): safeImageUrl for FeaturesGrid/ContentSlider image sinks + tighten data:image allowlist

2026-07-12 19:53:02 -07:00

form-relay-wiring.test.ts

fix(builder): deterministic ids for NumberCounter + form-relay marker

2026-07-12 14:43:31 -07:00

form-relay-wiring.ts

fix(builder): deterministic ids for NumberCounter + form-relay marker

2026-07-12 14:43:31 -07:00

html-export.test.ts

fix(builder): sanitize non-string style values + allowlist element tags (XSS)

2026-07-12 17:44:59 -07:00

html-export.ts

fix(builder): sanitize non-string style values + allowlist element tags (XSS)

2026-07-12 17:44:59 -07:00

sitesmith-target.ts

site-builder: dynamic CTAs, section anchors, edit-with-Sitesmith

2026-05-25 12:43:28 -07:00

style-helpers.test.ts

fix(builder): sanitize non-string style values + allowlist element tags (XSS)

2026-07-12 17:44:59 -07:00

style-helpers.ts

security: add safeImageUrl, un-break M-5's over-blocking of image-context SVG data URIs

2026-07-12 19:45:58 -07:00