@lowdefy/blocks-basic 0.0.0-experimental-20260904141432 → 0.0.0-experimental-20260905100314

package/dist/blocks/DangerousHtml/DangerousHtml.js

@@ -17,13 +17,20 @@ import DOMPurify from 'dompurify';
 import { withBlockDefaults } from '@lowdefy/block-utils';
 import { type } from '@lowdefy/helpers';
 let DangerousHtml = class DangerousHtml extends React.Component {
-    componentDidMount() {
-        const htmlString = type.isNone(this.props.properties.html) ? '' : this.props.properties.html.toString();
+    sanitize() {
+        const { html, DOMPurifyOptions } = this.props.properties;
+        if (!this.warnedOptionsChange && JSON.stringify(DOMPurifyOptions) !== JSON.stringify(this.DOMPurifyOptions)) {
+            this.warnedOptionsChange = true;
+            console.warn(`DangerousHtml block "${this.props.blockId}": DOMPurifyOptions changed after mount and the change is ignored. The sanitizer options are fixed at the first render; write them as a literal, not from state.`);
+        }
+        const htmlString = type.isNone(html) ? '' : html.toString();
         this.div.innerHTML = DOMPurify.sanitize(htmlString, this.DOMPurifyOptions);
     }
+    componentDidMount() {
+        this.sanitize();
+    }
     componentDidUpdate() {
-        const htmlString = type.isNone(this.props.properties.html) ? '' : this.props.properties.html.toString();
-        this.div.innerHTML = DOMPurify.sanitize(htmlString, this.DOMPurifyOptions);
+        this.sanitize();
     }
     render() {
         const { blockId, classNames, styles } = this.props;
@@ -44,8 +51,11 @@ let DangerousHtml = class DangerousHtml extends React.Component {
         this.div = {
             innerHTML: ''
         };
-        // we do not revaluate DOMPurifyOptions improve options safety by not making options dynamic.
+        // The sanitizer options are fixed at mount on purpose: a later, operator-driven
+        // value could loosen the sanitizer from state. A change is refused loudly
+        // rather than ignored silently.
         this.DOMPurifyOptions = props.properties.DOMPurifyOptions;
+        this.warnedOptionsChange = false;
     }
 };
 export default withBlockDefaults(DangerousHtml);

package/dist/blocks/DangerousHtml/meta.js

@@ -19,6 +19,18 @@
     cssKeys: {
         element: 'The DangerousHtml element.'
     },
+    hazards: [
+        {
+            id: 'dangerous-html-unsanitised',
+            message: 'Content is rendered without sanitising, so never pass caller-supplied or database HTML through it. Use Html for anything a user could have written.',
+            see: 'display-blocks/dangeroushtml'
+        },
+        {
+            id: 'dompurify-options-first-render',
+            message: 'DOMPurifyOptions is read once when the block mounts, so a value that changes after the first render has no effect. Set it statically or remount the block.',
+            see: 'display-blocks/dangeroushtml'
+        }
+    ],
     properties: {
         type: 'object',
         additionalProperties: false,

package/dist/blocks/Html/meta.js

@@ -19,6 +19,13 @@
     cssKeys: {
         element: 'The Html element.'
     },
+    hazards: [
+        {
+            id: 'html-style-stripped',
+            message: 'Content is sanitised with DOMPurify, so <style>, <script> and inline event handlers are removed before render. Use DangerousHtml for a trusted <style> block, or style the block through its style and class properties.',
+            see: 'display-blocks/html'
+        }
+    ],
     events: {
         onTextSelection: 'Trigger action when text is selected and pass selected text to the event object.'
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/blocks-basic",
-  "version": "0.0.0-experimental-20260904141432",
+  "version": "0.0.0-experimental-20260905100314",
   "license": "Apache-2.0",
   "description": "Basic html Lowdefy blocks.",
   "homepage": "https://lowdefy.com",
@@ -42,8 +42,8 @@
     "dist/*"
   ],
   "dependencies": {
-    "@lowdefy/block-utils": "0.0.0-experimental-20260904141432",
-    "@lowdefy/helpers": "0.0.0-experimental-20260904141432",
+    "@lowdefy/block-utils": "0.0.0-experimental-20260905100314",
+    "@lowdefy/helpers": "0.0.0-experimental-20260905100314",
     "dompurify": "3.4.2"
   },
   "peerDependencies": {
@@ -51,8 +51,8 @@
     "react-dom": ">=18"
   },
   "devDependencies": {
-    "@lowdefy/block-dev-e2e": "0.0.0-experimental-20260904141432",
-    "@lowdefy/e2e-utils": "0.0.0-experimental-20260904141432",
+    "@lowdefy/block-dev-e2e": "0.0.0-experimental-20260905100314",
+    "@lowdefy/e2e-utils": "0.0.0-experimental-20260905100314",
     "@playwright/test": "1.59.1",
     "@swc/cli": "0.8.1",
     "@swc/core": "1.15.32",