@instructure/platform-sanitize 0.3.12 → 0.3.14

package/dist/__tests__/sanitizeHtml.browser.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sanitizeHtml.browser.test.d.ts.map

package/dist/__tests__/sanitizeHtml.browser.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeHtml.browser.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/sanitizeHtml.browser.test.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -1,5 +1,5 @@
 import c from "dompurify";
-const b = /* @__PURE__ */ new Set([
+const p = /* @__PURE__ */ new Set([
   // layout
   "display",
   "float",
@@ -106,6 +106,13 @@ const b = /* @__PURE__ */ new Set([
   "border-style",
   "border-width",
   "border-radius",
+  // Chrome's CSSOM expands border-radius to these four longhands when iterating
+  // element.style — the shorthand itself never appears in the iterator, so the
+  // hook would strip all four corners unless they are explicitly listed here.
+  "border-top-left-radius",
+  "border-top-right-radius",
+  "border-bottom-right-radius",
+  "border-bottom-left-radius",
   "border-collapse",
   "border-spacing",
   "border-top",
@@ -130,6 +137,9 @@ const b = /* @__PURE__ */ new Set([
   "outline-color",
   "outline-style",
   "outline-width",
+  // outline-offset is not part of the `outline` shorthand, so it must be listed
+  // separately or it is stripped when authored on its own (focus-ring styling).
+  "outline-offset",
   // list
   "list-style",
   "list-style-image",
@@ -218,10 +228,11 @@ const b = /* @__PURE__ */ new Set([
   "counter-increment",
   "content",
   // UI / interaction
-  // pointer-events is included: RCE uses it legitimately (e.g. non-interactive
-  // decorative overlays). It is not in the overlay-phishing class because it
-  // cannot reposition elements — position/z-index remain blocked.
+  // pointer-events and z-index are safe: neither can reposition elements
+  // outside the container. The overlay-phishing risk comes from position:fixed/sticky,
+  // which SAFE_POSITION_VALUES strips.
   "pointer-events",
+  "z-index",
   "caret-color",
   "accent-color",
   "appearance"
@@ -279,7 +290,8 @@ const b = /* @__PURE__ */ new Set([
     // expressions; `arg` labels sub-expressions referenced by intent.
     // These are plain string annotations — no URL-loading, no code execution.
     "intent",
-    "arg"
+    "arg",
+    "loading"
   ],
   // Rails UJS turns data-method/data-remote/etc. on clickable elements into
   // state-changing requests carrying the victim's CSRF token. Strip them so
@@ -307,7 +319,7 @@ function k() {
     const e = t.style, o = [];
     for (let n = 0; n < e.length; n++) {
       const a = e.item(n);
-      b.has(a) || o.push(a);
+      p.has(a) || o.push(a);
     }
     for (const n of o) e.removeProperty(n);
     const r = /* @__PURE__ */ new Set([
@@ -348,7 +360,7 @@ function R(t, e) {
   const o = e != null && e.allowFormAttributeNames ? { ...d, SANITIZE_DOM: !1 } : d;
   return k().sanitize(t ?? "", o);
 }
-const f = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "http://platform-sanitize.invalid/", g = /^\s*\/\//, p = (
+const f = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "http://platform-sanitize.invalid/", b = /^\s*\/\//, g = (
   // oxlint-disable-next-line no-control-regex -- intentional security guard
   /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
 ), A = {
@@ -386,10 +398,10 @@ function E(t) {
 function S(t) {
   if (!t || !t.trim()) return "about:blank";
   const e = t.replace(/\\/g, "/");
-  if (g.test(e) || p.test(e)) return "about:blank";
+  if (b.test(e) || g.test(e)) return "about:blank";
   if (/&[#A-Za-z]/.test(e)) {
     const o = E(e);
-    if (g.test(o) || p.test(o))
+    if (b.test(o) || g.test(o))
       return "about:blank";
     try {
       const r = new URL(o, l);

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA6aA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAybA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -22,9 +22,12 @@
   },
   "devDependencies": {
     "@types/trusted-types": "^2.0.7",
+    "@vitest/browser": "^4.0.17",
+    "@vitest/browser-playwright": "^4.0.17",
     "@vitest/coverage-v8": "^4.0.17",
     "dompurify": "^3.4.0",
     "jsdom": "^25.0.0",
+    "playwright": "^1.60.0",
     "typescript": "^5.3.0",
     "vite": "^6.0.0",
     "vite-plugin-dts": "^4.0.0",
@@ -34,6 +37,7 @@
     "build": "vite build",
     "dev": "vite build --watch",
     "test": "vitest run",
+    "test:browser": "vitest run --config vitest.browser.config.ts",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "type-check": "tsc --noEmit"