@instructure/platform-assignment-review 0.4.16 → 0.4.17

package/dist/index.js

@@ -4,7 +4,7 @@ import { Flex as b } from "@instructure/ui-flex";
 import { Heading as St } from "@instructure/ui-heading";
 import { Spinner as Ye } from "@instructure/ui-spinner";
 import { Text as _ } from "@instructure/ui-text";
-import { View as K } from "@instructure/ui-view";
+import { View as Z } from "@instructure/ui-view";
 import { useQuery as Ve, useQueryClient as un, useMutation as dn } from "@tanstack/react-query";
 import ae from "graphql-tag";
 import { z as o } from "zod";
@@ -289,14 +289,14 @@ function _n() {
   }));
   let Ot = !0, Qe = !0, Nt = !1, vt = !0, re = !1, Ce = !0, me = !1, Je = !1, et = !1, pe = !1, Ue = !1, ze = !1, Lt = !0, xt = !1;
   const kt = "user-content-";
-  let tt = !0, De = !1, ge = {}, Z = null;
+  let tt = !0, De = !1, ge = {}, Q = null;
   const nt = T({}, ["annotation-xml", "audio", "colgroup", "desc", "foreignobject", "head", "iframe", "math", "mi", "mn", "mo", "ms", "mtext", "noembed", "noframes", "noscript", "plaintext", "script", "style", "svg", "template", "thead", "title", "video", "xmp"]);
   let Mt = null;
   const Pt = T({}, ["audio", "video", "img", "source", "image", "track"]);
   let it = null;
-  const Ft = T({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]), je = "http://www.w3.org/1998/Math/MathML", He = "http://www.w3.org/2000/svg", Q = "http://www.w3.org/1999/xhtml";
-  let he = Q, ot = !1, rt = null;
-  const Nn = T({}, [je, He, Q], dt);
+  const Ft = T({}, ["alt", "class", "for", "id", "label", "name", "pattern", "placeholder", "role", "summary", "title", "value", "style", "xmlns"]), je = "http://www.w3.org/1998/Math/MathML", He = "http://www.w3.org/2000/svg", J = "http://www.w3.org/1999/xhtml";
+  let he = J, ot = !1, rt = null;
+  const Nn = T({}, [je, He, J], dt);
   let st = T({}, ["mi", "mo", "mn", "ms", "mtext"]), at = T({}, ["annotation-xml"]);
   const vn = T({}, ["title", "style", "font", "a", "script"]);
   let Re = null;
@@ -309,9 +309,9 @@ function _n() {
     if (be && be === e)
       return;
     (!e || typeof e != "object") && (e = {}), e = W(e), Re = // eslint-disable-next-line unicorn/prefer-includes
-    Ln.indexOf(e.PARSER_MEDIA_TYPE) === -1 ? xn : e.PARSER_MEDIA_TYPE, k = Re === "application/xhtml+xml" ? dt : Ne, P = D(e, "ALLOWED_TAGS") && H(e.ALLOWED_TAGS) ? T({}, e.ALLOWED_TAGS, k) : Dt, U = D(e, "ALLOWED_ATTR") && H(e.ALLOWED_ATTR) ? T({}, e.ALLOWED_ATTR, k) : Rt, rt = D(e, "ALLOWED_NAMESPACES") && H(e.ALLOWED_NAMESPACES) ? T({}, e.ALLOWED_NAMESPACES, dt) : Nn, it = D(e, "ADD_URI_SAFE_ATTR") && H(e.ADD_URI_SAFE_ATTR) ? T(W(Ft), e.ADD_URI_SAFE_ATTR, k) : Ft, Mt = D(e, "ADD_DATA_URI_TAGS") && H(e.ADD_DATA_URI_TAGS) ? T(W(Pt), e.ADD_DATA_URI_TAGS, k) : Pt, Z = D(e, "FORBID_CONTENTS") && H(e.FORBID_CONTENTS) ? T({}, e.FORBID_CONTENTS, k) : nt, we = D(e, "FORBID_TAGS") && H(e.FORBID_TAGS) ? T({}, e.FORBID_TAGS, k) : W({}), Fe = D(e, "FORBID_ATTR") && H(e.FORBID_ATTR) ? T({}, e.FORBID_ATTR, k) : W({}), ge = D(e, "USE_PROFILES") ? e.USE_PROFILES && typeof e.USE_PROFILES == "object" ? W(e.USE_PROFILES) : e.USE_PROFILES : !1, Ot = e.ALLOW_ARIA_ATTR !== !1, Qe = e.ALLOW_DATA_ATTR !== !1, Nt = e.ALLOW_UNKNOWN_PROTOCOLS || !1, vt = e.ALLOW_SELF_CLOSE_IN_ATTR !== !1, re = e.SAFE_FOR_TEMPLATES || !1, Ce = e.SAFE_FOR_XML !== !1, me = e.WHOLE_DOCUMENT || !1, pe = e.RETURN_DOM || !1, Ue = e.RETURN_DOM_FRAGMENT || !1, ze = e.RETURN_TRUSTED_TYPE || !1, et = e.FORCE_BODY || !1, Lt = e.SANITIZE_DOM !== !1, xt = e.SANITIZE_NAMED_PROPS || !1, tt = e.KEEP_CONTENT !== !1, De = e.IN_PLACE || !1, Ct = hi(e.ALLOWED_URI_REGEXP) ? e.ALLOWED_URI_REGEXP : cn, he = typeof e.NAMESPACE == "string" ? e.NAMESPACE : Q, st = D(e, "MATHML_TEXT_INTEGRATION_POINTS") && e.MATHML_TEXT_INTEGRATION_POINTS && typeof e.MATHML_TEXT_INTEGRATION_POINTS == "object" ? W(e.MATHML_TEXT_INTEGRATION_POINTS) : T({}, ["mi", "mo", "mn", "ms", "mtext"]), at = D(e, "HTML_INTEGRATION_POINTS") && e.HTML_INTEGRATION_POINTS && typeof e.HTML_INTEGRATION_POINTS == "object" ? W(e.HTML_INTEGRATION_POINTS) : T({}, ["annotation-xml"]);
+    Ln.indexOf(e.PARSER_MEDIA_TYPE) === -1 ? xn : e.PARSER_MEDIA_TYPE, k = Re === "application/xhtml+xml" ? dt : Ne, P = D(e, "ALLOWED_TAGS") && H(e.ALLOWED_TAGS) ? T({}, e.ALLOWED_TAGS, k) : Dt, U = D(e, "ALLOWED_ATTR") && H(e.ALLOWED_ATTR) ? T({}, e.ALLOWED_ATTR, k) : Rt, rt = D(e, "ALLOWED_NAMESPACES") && H(e.ALLOWED_NAMESPACES) ? T({}, e.ALLOWED_NAMESPACES, dt) : Nn, it = D(e, "ADD_URI_SAFE_ATTR") && H(e.ADD_URI_SAFE_ATTR) ? T(W(Ft), e.ADD_URI_SAFE_ATTR, k) : Ft, Mt = D(e, "ADD_DATA_URI_TAGS") && H(e.ADD_DATA_URI_TAGS) ? T(W(Pt), e.ADD_DATA_URI_TAGS, k) : Pt, Q = D(e, "FORBID_CONTENTS") && H(e.FORBID_CONTENTS) ? T({}, e.FORBID_CONTENTS, k) : nt, we = D(e, "FORBID_TAGS") && H(e.FORBID_TAGS) ? T({}, e.FORBID_TAGS, k) : W({}), Fe = D(e, "FORBID_ATTR") && H(e.FORBID_ATTR) ? T({}, e.FORBID_ATTR, k) : W({}), ge = D(e, "USE_PROFILES") ? e.USE_PROFILES && typeof e.USE_PROFILES == "object" ? W(e.USE_PROFILES) : e.USE_PROFILES : !1, Ot = e.ALLOW_ARIA_ATTR !== !1, Qe = e.ALLOW_DATA_ATTR !== !1, Nt = e.ALLOW_UNKNOWN_PROTOCOLS || !1, vt = e.ALLOW_SELF_CLOSE_IN_ATTR !== !1, re = e.SAFE_FOR_TEMPLATES || !1, Ce = e.SAFE_FOR_XML !== !1, me = e.WHOLE_DOCUMENT || !1, pe = e.RETURN_DOM || !1, Ue = e.RETURN_DOM_FRAGMENT || !1, ze = e.RETURN_TRUSTED_TYPE || !1, et = e.FORCE_BODY || !1, Lt = e.SANITIZE_DOM !== !1, xt = e.SANITIZE_NAMED_PROPS || !1, tt = e.KEEP_CONTENT !== !1, De = e.IN_PLACE || !1, Ct = hi(e.ALLOWED_URI_REGEXP) ? e.ALLOWED_URI_REGEXP : cn, he = typeof e.NAMESPACE == "string" ? e.NAMESPACE : J, st = D(e, "MATHML_TEXT_INTEGRATION_POINTS") && e.MATHML_TEXT_INTEGRATION_POINTS && typeof e.MATHML_TEXT_INTEGRATION_POINTS == "object" ? W(e.MATHML_TEXT_INTEGRATION_POINTS) : T({}, ["mi", "mo", "mn", "ms", "mtext"]), at = D(e, "HTML_INTEGRATION_POINTS") && e.HTML_INTEGRATION_POINTS && typeof e.HTML_INTEGRATION_POINTS == "object" ? W(e.HTML_INTEGRATION_POINTS) : T({}, ["annotation-xml"]);
     const a = D(e, "CUSTOM_ELEMENT_HANDLING") && e.CUSTOM_ELEMENT_HANDLING && typeof e.CUSTOM_ELEMENT_HANDLING == "object" ? W(e.CUSTOM_ELEMENT_HANDLING) : _e(null);
-    if (R = _e(null), D(a, "tagNameCheck") && Ut(a.tagNameCheck) && (R.tagNameCheck = a.tagNameCheck), D(a, "attributeNameCheck") && Ut(a.attributeNameCheck) && (R.attributeNameCheck = a.attributeNameCheck), D(a, "allowCustomizedBuiltInElements") && typeof a.allowCustomizedBuiltInElements == "boolean" && (R.allowCustomizedBuiltInElements = a.allowCustomizedBuiltInElements), re && (Qe = !1), Ue && (pe = !0), ge && (P = T({}, sn), U = _e(null), ge.html === !0 && (T(P, rn), T(U, an)), ge.svg === !0 && (T(P, ft), T(U, ht), T(U, We)), ge.svgFilters === !0 && (T(P, pt), T(U, ht), T(U, We)), ge.mathMl === !0 && (T(P, gt), T(U, ln), T(U, We))), oe.tagCheck = null, oe.attributeCheck = null, D(e, "ADD_TAGS") && (typeof e.ADD_TAGS == "function" ? oe.tagCheck = e.ADD_TAGS : H(e.ADD_TAGS) && (P === Dt && (P = W(P)), T(P, e.ADD_TAGS, k))), D(e, "ADD_ATTR") && (typeof e.ADD_ATTR == "function" ? oe.attributeCheck = e.ADD_ATTR : H(e.ADD_ATTR) && (U === Rt && (U = W(U)), T(U, e.ADD_ATTR, k))), D(e, "ADD_URI_SAFE_ATTR") && H(e.ADD_URI_SAFE_ATTR) && T(it, e.ADD_URI_SAFE_ATTR, k), D(e, "FORBID_CONTENTS") && H(e.FORBID_CONTENTS) && (Z === nt && (Z = W(Z)), T(Z, e.FORBID_CONTENTS, k)), D(e, "ADD_FORBID_CONTENTS") && H(e.ADD_FORBID_CONTENTS) && (Z === nt && (Z = W(Z)), T(Z, e.ADD_FORBID_CONTENTS, k)), tt && (P["#text"] = !0), me && T(P, ["html", "head", "body"]), P.table && (T(P, ["tbody"]), delete we.tbody), e.TRUSTED_TYPES_POLICY) {
+    if (R = _e(null), D(a, "tagNameCheck") && Ut(a.tagNameCheck) && (R.tagNameCheck = a.tagNameCheck), D(a, "attributeNameCheck") && Ut(a.attributeNameCheck) && (R.attributeNameCheck = a.attributeNameCheck), D(a, "allowCustomizedBuiltInElements") && typeof a.allowCustomizedBuiltInElements == "boolean" && (R.allowCustomizedBuiltInElements = a.allowCustomizedBuiltInElements), re && (Qe = !1), Ue && (pe = !0), ge && (P = T({}, sn), U = _e(null), ge.html === !0 && (T(P, rn), T(U, an)), ge.svg === !0 && (T(P, ft), T(U, ht), T(U, We)), ge.svgFilters === !0 && (T(P, pt), T(U, ht), T(U, We)), ge.mathMl === !0 && (T(P, gt), T(U, ln), T(U, We))), oe.tagCheck = null, oe.attributeCheck = null, D(e, "ADD_TAGS") && (typeof e.ADD_TAGS == "function" ? oe.tagCheck = e.ADD_TAGS : H(e.ADD_TAGS) && (P === Dt && (P = W(P)), T(P, e.ADD_TAGS, k))), D(e, "ADD_ATTR") && (typeof e.ADD_ATTR == "function" ? oe.attributeCheck = e.ADD_ATTR : H(e.ADD_ATTR) && (U === Rt && (U = W(U)), T(U, e.ADD_ATTR, k))), D(e, "ADD_URI_SAFE_ATTR") && H(e.ADD_URI_SAFE_ATTR) && T(it, e.ADD_URI_SAFE_ATTR, k), D(e, "FORBID_CONTENTS") && H(e.FORBID_CONTENTS) && (Q === nt && (Q = W(Q)), T(Q, e.FORBID_CONTENTS, k)), D(e, "ADD_FORBID_CONTENTS") && H(e.ADD_FORBID_CONTENTS) && (Q === nt && (Q = W(Q)), T(Q, e.ADD_FORBID_CONTENTS, k)), tt && (P["#text"] = !0), me && T(P, ["html", "head", "body"]), P.table && (T(P, ["tbody"]), delete we.tbody), e.TRUSTED_TYPES_POLICY) {
       if (typeof e.TRUSTED_TYPES_POLICY.createHTML != "function")
         throw Ge('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');
       if (typeof e.TRUSTED_TYPES_POLICY.createScriptURL != "function")
@@ -327,7 +327,7 @@ function _n() {
       tagName: "template"
     });
     const u = Ne(e.tagName), A = Ne(a.tagName);
-    return rt[e.namespaceURI] ? e.namespaceURI === He ? a.namespaceURI === Q ? u === "svg" : a.namespaceURI === je ? u === "svg" && (A === "annotation-xml" || st[A]) : !!zt[u] : e.namespaceURI === je ? a.namespaceURI === Q ? u === "math" : a.namespaceURI === He ? u === "math" && at[A] : !!jt[u] : e.namespaceURI === Q ? a.namespaceURI === He && !at[A] || a.namespaceURI === je && !st[A] ? !1 : !jt[u] && (vn[u] || !zt[u]) : !!(Re === "application/xhtml+xml" && rt[e.namespaceURI]) : !1;
+    return rt[e.namespaceURI] ? e.namespaceURI === He ? a.namespaceURI === J ? u === "svg" : a.namespaceURI === je ? u === "svg" && (A === "annotation-xml" || st[A]) : !!zt[u] : e.namespaceURI === je ? a.namespaceURI === J ? u === "math" : a.namespaceURI === He ? u === "math" && at[A] : !!jt[u] : e.namespaceURI === J ? a.namespaceURI === He && !at[A] || a.namespaceURI === je && !st[A] ? !1 : !jt[u] && (vn[u] || !zt[u]) : !!(Re === "application/xhtml+xml" && rt[e.namespaceURI]) : !1;
   }, X = function(e) {
     ye(n.removed, {
       element: e
@@ -368,9 +368,9 @@ function _n() {
       const L = en(e, /^[\r\n\t ]+/);
       u = L && L[0];
     }
-    Re === "application/xhtml+xml" && he === Q && (e = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + e + "</body></html>");
+    Re === "application/xhtml+xml" && he === J && (e = '<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body>' + e + "</body></html>");
     const A = E ? E.createHTML(e) : e;
-    if (he === Q)
+    if (he === J)
       try {
         a = new w().parseFromString(A, Re);
       } catch {
@@ -383,7 +383,7 @@ function _n() {
       }
     }
     const v = a.body || a.documentElement;
-    return e && u && v.insertBefore(i.createTextNode(u), v.childNodes[0] || null), he === Q ? Ke.call(a, me ? "html" : "body")[0] : me ? a.documentElement : v;
+    return e && u && v.insertBefore(i.createTextNode(u), v.childNodes[0] || null), he === J ? Ke.call(a, me ? "html" : "body")[0] : me ? a.documentElement : v;
   }, $t = function(e) {
     return xe.call(
       e.ownerDocument || e,
@@ -432,12 +432,12 @@ function _n() {
     if (te(j.uponSanitizeElement, e, {
       tagName: u,
       allowedTags: P
-    }), Ce && e.hasChildNodes() && !$e(e.firstElementChild) && z(/<[/\w!]/g, e.innerHTML) && z(/<[/\w!]/g, e.textContent) || Ce && e.namespaceURI === Q && u === "style" && $e(e.firstElementChild) || e.nodeType === Se.progressingInstruction || Ce && e.nodeType === Se.comment && z(/<[/\w]/g, e.data))
+    }), Ce && e.hasChildNodes() && !$e(e.firstElementChild) && z(/<[/\w!]/g, e.innerHTML) && z(/<[/\w!]/g, e.textContent) || Ce && e.namespaceURI === J && u === "style" && $e(e.firstElementChild) || e.nodeType === Se.progressingInstruction || Ce && e.nodeType === Se.comment && z(/<[/\w]/g, e.data))
       return X(e), !0;
     if (we[u] || !(oe.tagCheck instanceof Function && oe.tagCheck(u)) && !P[u]) {
       if (!we[u] && qt(u) && (R.tagNameCheck instanceof RegExp && z(R.tagNameCheck, u) || R.tagNameCheck instanceof Function && R.tagNameCheck(u)))
         return !1;
-      if (tt && !Z[u]) {
+      if (tt && !Q[u]) {
         const A = O(e) || e.parentNode, v = ie(e) || e.childNodes;
         if (v && A) {
           const L = v.length;
@@ -913,7 +913,26 @@ const Ni = /* @__PURE__ */ new Set([
   // application/x-tex, …) are not integration points and are preserved, so this
   // layer no longer strips the benign annotation-xml the backend and TinyMCE
   // already allow.
-  ADD_TAGS: ["iframe", "semantics", "annotation", "annotation-xml"],
+  // object/embed/param re-enable PDF/SVG/media embedding in course content
+  // (e.g. <object data="file.pdf" type="application/pdf">). Their Flash/ActiveX
+  // attributes (classid, codebase, pluginspage, wmode, allowscriptaccess) are
+  // intentionally NOT added — dead tech, and ADD_ATTR is global in DOMPurify so
+  // re-allowing them would also reopen that surface on iframe. DOMPurify's URI
+  // filter blocks javascript:/data: on data/src, matching Canvas's
+  // http/https/relative protocol rule for these tags.
+  //
+  // SECURITY ASSUMPTION (same one iframe already relies on): object/embed load
+  // their resource as a *document*, not an image — a same-origin SVG/HTML file
+  // (e.g. <object data="/files/123/download" type="image/svg+xml">) executes any
+  // <script> it contains in the embedding page's origin. The javascript:/data:
+  // filter does not help here because the URL is a benign same-origin path; the
+  // payload lives in the fetched file. This is NOT new attack surface: <iframe>
+  // is already allowed and has the identical capability (its srcdoc is stripped —
+  // see test). The defense for all three is that Canvas serves user-uploaded
+  // files from a separate sandboxed origin. object/embed also have no usable
+  // sandbox attribute, so the sandbox-token hook cannot constrain them — again,
+  // parity with an unsandboxed iframe, which is already permitted.
+  ADD_TAGS: ["iframe", "semantics", "annotation", "annotation-xml", "object", "embed", "param"],
   ADD_ATTR: [
     "allowfullscreen",
     "allow",
@@ -921,6 +940,12 @@ const Ni = /* @__PURE__ */ new Set([
     "sandbox",
     "data-media-id",
     "data-media-type",
+    // <object>'s resource URL attribute — not in DOMPurify's defaults. src/type/
+    // name/value/width/height (used by object/embed/param) already are. Added
+    // globally (DOMPurify has no per-tag attr scoping), which is harmless: `data`
+    // is in URL_ATTRS so it is protocol-filtered, and it is not a DOM-clobbering
+    // or URI-safe attribute name.
+    "data",
     // RCE produces target="_blank" for external links. Modern browsers treat
     // target="_blank" as implicit rel="noopener", and the backend allowlist
     // already includes target.
@@ -957,10 +982,10 @@ const Ni = /* @__PURE__ */ new Set([
   // confusion attacks where fragments like <svg> could influence parse context.
   FORCE_BODY: !0
 };
-let J = null;
+let K = null;
 function Pi() {
-  if (J) return J;
-  J = typeof bt == "function" ? bt(window) : bt, J.addHook("afterSanitizeAttributes", (n) => {
+  if (K) return K;
+  K = typeof bt == "function" ? bt(window) : bt, K.addHook("afterSanitizeAttributes", (n) => {
     if (!(n instanceof Element) || !n.hasAttribute("style")) return;
     const i = n.style, s = [];
     for (let m = 0; m < i.length; m++) {
@@ -986,11 +1011,11 @@ function Pi() {
       f && xi.test(f) && i.removeProperty(m);
     }
     i.length === 0 && n.removeAttribute("style");
-  }), J.addHook("uponSanitizeAttribute", (n, i) => {
+  }), K.addHook("uponSanitizeAttribute", (n, i) => {
     if (!vi.has(i.attrName)) return;
     const s = i.attrValue;
     /^\s*\/\//.test(s) ? (i.attrValue = s.trimStart().replace(/^\/\//, "https://"), i.keepAttr = !0) : /^\s*\\/.test(s) && (i.keepAttr = !1);
-  }), J.addHook("afterSanitizeAttributes", (n) => {
+  }), K.addHook("afterSanitizeAttributes", (n) => {
     if (!(n instanceof Element) || !n.hasAttribute("srcset")) return;
     const i = (n.getAttribute("srcset") ?? "").split(","), s = (d) => d.trim().split(/\s+/)[0];
     if (i.some((d) => /^\s*\\/.test(s(d)))) {
@@ -1006,22 +1031,26 @@ function Pi() {
       return d.slice(0, m) + "https://" + p.slice(2) + d.slice(m + p.length);
     });
     l && n.setAttribute("srcset", c.join(","));
-  }), J.addHook("afterSanitizeAttributes", (n) => {
+  }), K.addHook("afterSanitizeAttributes", (n) => {
     var i;
     if (!(n instanceof Element) || n.tagName !== "A" && n.tagName !== "AREA" || ((i = n.getAttribute("target")) == null ? void 0 : i.toLowerCase()) !== "_blank") return;
     const s = n.getAttribute("rel") ?? "", l = new Set(s.split(/\s+/).filter(Boolean));
     l.add("noopener"), n.setAttribute("rel", [...l].join(" "));
-  }), J.addHook("afterSanitizeAttributes", (n) => {
+  }), K.addHook("afterSanitizeAttributes", (n) => {
     if (!(n instanceof Element) || n.tagName !== "IFRAME" || !n.hasAttribute("sandbox")) return;
     const i = (n.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), s = i.filter((l) => ki.has(l));
     s.length !== i.length && n.setAttribute("sandbox", s.join(" "));
+  }), K.addHook("afterSanitizeAttributes", (n) => {
+    if (!(n instanceof Element) || n.tagName !== "PARAM") return;
+    const i = n.getAttribute("value");
+    i && /^\s*(?:javascript|vbscript):/i.test(i) && n.removeAttribute("value");
   });
   const t = /* @__PURE__ */ new Set(["text/html", "application/xhtml+xml"]);
-  return J.addHook("afterSanitizeElements", (n) => {
+  return K.addHook("afterSanitizeElements", (n) => {
     if (!(n instanceof Element) || n.tagName.toLowerCase() !== "annotation-xml") return;
     const i = (n.getAttribute("encoding") ?? "").toLowerCase().trim();
     t.has(i) && n.remove();
-  }), J;
+  }), K;
 }
 function It(t, n) {
   if (typeof window > "u")
@@ -1400,7 +1429,7 @@ function Qi({
 }) {
   const c = q(), d = i ? c.submissionCurrentAttempt() : c.commentsAttempt({ number: t.attempt }), p = t.score != null && s != null ? `${t.score}/${s}` : null;
   return /* @__PURE__ */ r(
-    K,
+    Z,
     {
       as: "div",
       padding: "small medium",
@@ -1460,7 +1489,7 @@ function wn({
   size: n = "medium"
 }) {
   return t.length === 0 ? null : /* @__PURE__ */ r(b, { direction: "column", gap: "x-small", children: t.map((i) => /* @__PURE__ */ r(
-    K,
+    Z,
     {
       as: "div",
       padding: n === "small" ? "x-small" : "small medium",
@@ -1492,15 +1521,15 @@ function to({
         C.some((w) => w.id === I.id) || C.push(I);
     return C;
   }, [t]), h = qe(() => c((t == null ? void 0 : t.body) ?? ""), [t == null ? void 0 : t.body, c]);
-  return t ? /* @__PURE__ */ r(K, { as: "div", children: /* @__PURE__ */ S(b, { direction: "column", gap: "small", children: [
+  return t ? /* @__PURE__ */ r(Z, { as: "div", children: /* @__PURE__ */ S(b, { direction: "column", gap: "small", children: [
     i && !n && t.attempt != null && /* @__PURE__ */ r(_, { size: "small", weight: "bold", color: "secondary", children: l.submissionViewingAttempt({ number: t.attempt }) }),
     /* @__PURE__ */ S(b, { gap: "x-small", alignItems: "center", children: [
       /* @__PURE__ */ r($n, { color: "success" }),
       /* @__PURE__ */ r(St, { level: "h3", children: m })
     ] }),
     d && t.body && /* @__PURE__ */ S(b, { alignItems: "stretch", gap: "small", children: [
-      /* @__PURE__ */ r(K, { as: "div", width: "4px", background: "primary", borderRadius: "small" }),
-      /* @__PURE__ */ r(K, { as: "div", children: /* @__PURE__ */ r(_, { children: h }) })
+      /* @__PURE__ */ r(Z, { as: "div", width: "4px", background: "primary", borderRadius: "small" }),
+      /* @__PURE__ */ r(Z, { as: "div", children: /* @__PURE__ */ r(_, { children: h }) })
     ] }),
     p && f.length > 0 && /* @__PURE__ */ r(wn, { attachments: f })
   ] }) }) : null;
@@ -1811,7 +1840,7 @@ function fo({
   var m;
   const s = q(), l = i ?? mo, c = ((m = t.author.courseRoles) == null ? void 0 : m.includes("StudentEnrollment")) ?? !1, d = qe(() => l(t.htmlComment), [t.htmlComment, l]);
   return /* @__PURE__ */ r(
-    K,
+    Z,
     {
       as: "div",
       padding: "small medium",
@@ -2019,9 +2048,9 @@ function Wo({
         isOverdue: Ie
       }
     ),
-    h.description && /* @__PURE__ */ S(K, { as: "div", children: [
+    h.description && /* @__PURE__ */ S(Z, { as: "div", children: [
       /* @__PURE__ */ r(St, { level: "h3", children: m.assignmentInstructions() }),
-      /* @__PURE__ */ r(K, { as: "div", margin: "small none large none", children: f(h.description) })
+      /* @__PURE__ */ r(Z, { as: "div", margin: "small none large none", children: f(h.description) })
     ] }),
     /* @__PURE__ */ r(
       to,
@@ -2050,7 +2079,7 @@ function qo({
   }, C = p.map((w) => w.id), I = p.length > 0 && !c;
   return /* @__PURE__ */ S(b, { direction: "column", gap: "medium", children: [
     p.length > 0 && /* @__PURE__ */ r(b, { direction: "column", gap: "x-small", children: p.map((w) => /* @__PURE__ */ r(
-      K,
+      Z,
       {
         as: "div",
         padding: "small",
@@ -2155,7 +2184,7 @@ function bo({
 }) {
   var m, f, h, C, I;
   const l = q(), c = ((m = t.content_details) == null ? void 0 : m.locked_for_user) ?? !1, d = (f = t.content_details) == null ? void 0 : f.lock_explanation, p = /* @__PURE__ */ r(
-    K,
+    Z,
     {
       as: "div",
       padding: "small",
@@ -2202,7 +2231,7 @@ function Vo({
       /* @__PURE__ */ r(St, { level: "h3", children: h }),
       /* @__PURE__ */ r(Qn, { screenReaderLabel: f.navigationClosePanel(), onClick: s, size: "small", children: /* @__PURE__ */ r(qn, {}) })
     ] }),
-    /* @__PURE__ */ S(K, { as: "div", padding: "none small", overflowY: "auto", children: [
+    /* @__PURE__ */ S(Z, { as: "div", padding: "none small", overflowY: "auto", children: [
       t.state === "locked" && /* @__PURE__ */ r(b, { padding: "none none small", children: /* @__PURE__ */ S(_t, { color: "warning", children: [
         /* @__PURE__ */ r(gn, {}),
         " ",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-assignment-review",
-  "version": "0.4.16",
+  "version": "0.4.17",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -39,7 +39,7 @@
     "graphql": "^16.0.0",
     "graphql-tag": "^2.12.0",
     "zod": "^3.23.8",
-    "@instructure/platform-sanitize": "0.4.1"
+    "@instructure/platform-sanitize": "0.5.0"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",