@ng-prism/core 22.1.2 → 22.1.3

package/dist/app/renderer/prism-renderer.component.js

@@ -301,6 +301,10 @@ export class PrismRendererComponent {
                         read: ViewContainerRef,
                     }, isSignal: true }] }] }); })();
 (() => { (typeof ngDevMode === "undefined" || ngDevMode) && i0.ɵsetClassDebugInfo(PrismRendererComponent, { className: "PrismRendererComponent", filePath: "app/renderer/prism-renderer.component.ts", lineNumber: 180 }); })();
+// SAFETY: `content` originates from `@Showcase({ variants: [{ content }] })`
+// in developer-authored source code. It is trusted by ng-prism's threat model
+// (see SECURITY.md). Sanitization would strip the Angular component/directive
+// selectors that variant content is meant to project.
 function parseContentToNodes(content) {
     if (typeof content === 'string') {
         return [htmlToNodes(content)];
@@ -313,10 +317,12 @@ function parseContentToNodes(content) {
         if (selector === 'default')
             continue;
         const wrapper = document.createElement('div');
+        // SAFETY: trusted developer-authored HTML — see SECURITY.md.
         wrapper.innerHTML = html;
         const nodes = [];
         for (const child of Array.from(wrapper.childNodes)) {
             const el = document.createElement('div');
+            // SAFETY: trusted developer-authored HTML — see SECURITY.md.
             el.innerHTML = child.outerHTML ?? child.textContent ?? '';
             const projected = el.firstChild;
             if (projected && projected instanceof Element) {
@@ -334,6 +340,8 @@ function parseContentToNodes(content) {
     }
     return result;
 }
+// SAFETY: see `parseContentToNodes` above and SECURITY.md — `html` is trusted
+// developer-authored variant content from the `@Showcase` decorator.
 function htmlToNodes(html) {
     const wrapper = document.createElement('div');
     wrapper.innerHTML = html;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ng-prism/core",
-  "version": "22.1.2",
+  "version": "22.1.3",
   "description": "ng-prism — the Angular-native Storybook alternative. Lightweight component showcase with @Showcase decorator, no story files needed.",
   "keywords": [
     "ng-prism",