@clepit/core 0.6.0-beta.417 → 0.6.0-beta.421

package/CHANGELOG.md

@@ -21,6 +21,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - An editor given `locale` kept only the language being edited: an edit replaced a field's map of languages with one string. The editor now keeps each block's stored data and writes an edit back into it with the rule both twins share, on every way a block leaves it (`onChange`, `data.extract()`, `blocks.get` and `blocks.getAll`), while `blocks.insert`, `blocks.update` and `data.set` take stored data and show it in the language being edited. A converted block keeps the languages of the fields both types share.
 - An editor given no `locale` drew a translated field as "[object Object]". It now shows a translated document in the first of its languages, and keeps the others through an edit.
 - The inline toolbar no longer leaves a hidden copy of the rewrite menu behind each time a new selection repaints it, so each rewrite action exists once in the page.
+- A rewrite that the host's `onInlineRewrite` rejects is reported with `console.error`, and the passage stays as it was; it vanished silently before. A failure inside the inline or block toolbar now reaches the page's error reporting instead of being caught and dropped.
+
+### Security
+- Every block sanitises its stored markup when it draws it, on the editing path and the reading path alike, and the DOM backing's `setHtml` sanitises like the string backing. A paragraph, header, quote, alert, list or checklist item, or an image, video or audio caption stored with an event handler (by a client writing the document directly, for instance) no longer runs it in the browser of whoever opens the page.
+- `sanitizeHtml` parses into a document from `document.implementation.createHTMLDocument`, which has no browsing context, so markup is never handed to the live page while it is cleaned, and drops `javascript:`, `data:` and `vbscript:` link targets, as `sanitizeHtmlWithoutDom` already did. It still needs only `document`.
+- `sanitizeHtmlWithoutDom` reads a tag as a browser does: a quote opens a value only after `=` and is an ordinary character in a name or an unquoted value, a tag the input ends inside is dropped, and comments and declarations are dropped. A `<` or `>` left in text is escaped. One stray quote in a tag (`<img src=x onerror=alert(1) a"b>`) used to carry the whole tag, handler included, into every page drawn with `renderBlocks` or `renderPage`.
+- An issue chip, an issue card and a Linked issues row draw their link only for an http or https address, and a chip read back from a page or from markup keeps no other link or avatar address. A stored `javascript:` issue URL used to be redrawn as a live link.
 
 ## [0.6.0] - 2026-09-25
 

package/dist/core/element/index.d.ts

@@ -21,10 +21,9 @@ export type ClepitElement = {
     /**
      * Assign markup.
      *
-     * The DOM backing hands this to the browser's parser. The string backing has
-     * no parser, so it runs the value through the sanitiser it was constructed
-     * with — without that, stored document content would emit arbitrary markup
-     * into a server-rendered page.
+     * Both backings sanitise it, because stored document content is not trusted:
+     * the DOM backing with the editor's own sanitiser, the string backing (which
+     * has no parser) with the one it was constructed with.
      */
     setHtml(html: string): void;
     append(child: ClepitElement): void;