shadowdaoandClaude Opus 5.5 a113f25a62 Guard test: the capture-frame exception now fails on allow-scripts, a skipped or ignored sanitiser, or src= (G7)
captureFileViolations() pins the one allow-same-origin srcdoc frame: sandbox set
once to exactly allow-same-origin, no script/form/popup/navigation tokens,
srcdoc only from inlineResources(clean.html), sanitizeCaptureHtml called and its
verdict checked before srcdoc. Eight mutated copies of the real source prove
each rule fails. Plus a behavioural jsdom test of the real captureHtml frame.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-01 11:10:30 -08:00
S
Description
Visual drag-and-drop website builder using GrapesJS
6.6 MiB
0 Stars 6 Watchers 0 Forks
Languages
TypeScript 76%
JavaScript 12.2%
HTML 8.6%
CSS 2.6%
PHP 0.4%
Other 0.2%