Josh Knapp
bd15a33984
Closes XSS hole in HtmlBlock by sanitizing user/AI-supplied markup through DOMPurify before passing to dangerouslySetInnerHTML. Adds Vitest + jsdom for unit testing with 5 passing tests covering script stripping, on-event handler removal, javascript: URL blocking, iframe allowlist, and form/input stripping. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
35 lines
920 B
JSON
35 lines
920 B
JSON
{
|
|
"name": "whp-site-builder",
|
|
"private": true,
|
|
"version": "2.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc && vite build",
|
|
"preview": "vite preview",
|
|
"test": "playwright test tests/site-builder.spec.ts --reporter=list",
|
|
"test:headed": "playwright test tests/site-builder.spec.ts --reporter=list --headed",
|
|
"test:unit": "vitest run",
|
|
"test:unit:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"@craftjs/core": "^0.2.10",
|
|
"@craftjs/layers": "^0.2.7",
|
|
"dompurify": "^3.4.5",
|
|
"react": "^18.3.1",
|
|
"react-dom": "^18.3.1"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.59.1",
|
|
"@types/dompurify": "^3.0.5",
|
|
"@types/react": "^18.3.12",
|
|
"@types/react-dom": "^18.3.1",
|
|
"@vitejs/plugin-react": "^4.3.4",
|
|
"@vitest/ui": "^4.1.7",
|
|
"jsdom": "^29.1.1",
|
|
"typescript": "^5.6.3",
|
|
"vite": "^6.0.5",
|
|
"vitest": "^4.1.7"
|
|
}
|
|
}
|