@uniweb/kit 1.1.0 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/kit",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Standard component library for Uniweb foundations",
   "type": "module",
   "exports": {
@@ -43,11 +43,11 @@
     "shiki": "^3.0.0",
     "tailwind-merge": "^3.6.0",
     "temml": "^0.13.2",
-    "@uniweb/core": "~1.1.0",
-    "@uniweb/projections": "~1.1.0",
-    "@uniweb/semantic-parser": "~1.5.1",
+    "@uniweb/core": "~1.2.0",
+    "@uniweb/projections": "~1.1.1",
+    "@uniweb/semantic-parser": "~1.6.0",
     "@uniweb/scene": "~1.0.1",
-    "@uniweb/schemas": "~1.0.1"
+    "@uniweb/schemas": "~1.1.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/components/Icon/Icon.jsx

@@ -12,6 +12,7 @@
 
 import React, { useState, useEffect, useMemo } from 'react'
 import { getUniweb } from '@uniweb/core'
+import { sanitizeSVG } from '@uniweb/semantic-parser/sanitize'
 import { cn, parseIconRef } from '../../utils/index.js'
 
 /**
@@ -93,9 +94,13 @@ function parseSvg(svgContent) {
     const strokeLinecap = getAttr(svgTag, 'stroke-linecap')
     const strokeLinejoin = getAttr(svgTag, 'stroke-linejoin')
 
-    // Get inner content (everything between <svg> and </svg>)
+    // Get inner content (everything between <svg> and </svg>), rebuilt from
+    // the SVG allowlist before it is injected: an icon can come from content
+    // (an author's file, a pasted SVG) or from any URL, and markup from there
+    // may not run script. Built-in icons are constants and skip this.
+    // ⛔ Until 2026-10-14 the inner markup was injected as fetched.
     const innerMatch = svgContent.match(/<svg\s[^>]*>([\s\S]*)<\/svg>/i)
-    const content = innerMatch ? innerMatch[1] : ''
+    const content = innerMatch ? sanitizeSVG(innerMatch[1]) : ''
 
     return {
       viewBox, content, width, height,

package/src/components/SafeHtml/SafeHtml.jsx

@@ -9,14 +9,20 @@
  * The resolution itself lives in utils/href.js, shared with <Text>, so both
  * prose renderers agree on what an authored href means.
  *
- * WHAT "SAFE" DOES NOT MEAN
- * This component does NOT sanitize. Nothing in the framework does. The value
- * is rendered as-is, so it must come from a source you trust — which the
- * framework's own content is: the author of a site's markdown also writes its
- * foundation, so there is no privilege boundary to defend. A foundation that
- * renders genuinely untrusted HTML (say a user-submitted string arriving
- * through a fetcher) is responsible for that decision, and should not read
- * this component's name as a guarantee.
+ * WHAT MAKES IT SAFE — and what does not
+ * The value is rendered as HTML, as given; this component cleans nothing. A
+ * semantic-parser string is safe to give it because the parser builds it from
+ * structure and escapes every character of the text and every attribute value,
+ * and the only markup it lets through, a math node's MathML, it rebuilds from
+ * an allowlist (`@uniweb/semantic-parser`, since 2026-10-14).
+ *
+ * ⛔ So a string from anywhere else does not belong here — a field a member
+ * wrote, a response from an API. Render it as text. *(This said until
+ * 2026-10-14 that "nothing in the framework" sanitizes and that a site's
+ * author also writes its foundation, so there was no privilege boundary — a
+ * premise that fails wherever the person writing content is not the one
+ * writing code: an author using an editor, a member of a site with a
+ * backend.)*
  *
  * @module @uniweb/kit/SafeHtml
  */

package/src/components/Text/Text.jsx

@@ -5,10 +5,15 @@
  * Handles single strings or arrays of paragraphs with automatic semantic
  * tag selection and empty content filtering.
  *
- * Security Model:
- * - Assumes content is ALREADY SANITIZED at the engine level
- * - Does NOT sanitize HTML (that's the engine's responsibility)
- * - Trusts the data it receives and renders it as-is
+ * What it renders as HTML (`html`, true by default): a semantic-parser string.
+ * The parser builds it from structure and escapes every character of the text
+ * and every attribute value, so a `content.title` or a paragraph is safe to
+ * inject (`@uniweb/semantic-parser`, since 2026-10-14). Text renders it as
+ * given and adds no cleaning of its own.
+ *
+ * ⛔ A string from anywhere else is not parser output: a field a member wrote,
+ * a value an API returned. Render it as text — `html={false}` (`<PlainText>`),
+ * or `{value}` in JSX — or a member's `<img onerror>` runs as the viewer.
  *
  * @module @uniweb/kit/Text
  */

package/src/styled/Render/index.jsx

@@ -360,8 +360,9 @@ export function SequenceElement({ element, block, components }) {
 
     case 'math': {
       // MathML is pre-compiled at parse time; the browser renders it natively,
-      // so no runtime math library ships. Missing here until 2026-07-30, which
-      // is why math vanished from every <Article>.
+      // so no runtime math library ships. semantic-parser rebuilds it from the
+      // MathML allowlist before it gets here. Missing here until 2026-07-30,
+      // which is why math vanished from every <Article>.
       if (!element.mathml) return null
       const display = element.display !== false
       const Tag = display ? 'div' : 'span'

package/src/styled/Scene/index.jsx

@@ -1,4 +1,5 @@
 import { Scene as SceneRenderer, composeScene } from '@uniweb/scene'
+import { sanitizeSVG } from '@uniweb/semantic-parser/sanitize'
 
 // The @uniweb/scene renderer reads `--vc-*` custom properties for its default
 // colors (an explicit value in the scene JSON always wins). Text, font, and
@@ -22,14 +23,20 @@ const THEME_VARS = {
  * Maps the site's `--primary` / `--accent` tokens onto the renderer's decorative
  * defaults so an unstyled scene adopts the theme; text and fonts inherit the
  * section context automatically. All other props (`mobileBreakpoint`,
- * `initialWidth`, `sanitizeSvg`, `className`, `style`, and the editing hooks)
- * forward straight through.
+ * `initialWidth`, `className`, `style`, and the editing hooks) forward straight
+ * through.
+ *
+ * An svg layer's markup is injected, so it is rebuilt from the SVG allowlist
+ * first (`sanitizeSVG`, `@uniweb/semantic-parser/sanitize`) — a scene is content,
+ * and whoever composed it may not be the person who wrote the foundation. Pass
+ * your own `sanitizeSvg` to replace it. ⛔ Until 2026-10-14 nothing was passed by
+ * default, so a layer's `<script>` or `onload` ran on the page.
  *
  * @example
  *   <Scene composition={content.data.scene} />
  *   <Scene composition={template} overrides={{ title: { content: content.title } }} />
  */
-export function Scene({ composition, overrides, content, style, ...rest }) {
+export function Scene({ composition, overrides, content, style, sanitizeSvg = sanitizeSVG, ...rest }) {
   const data =
     overrides || content
       ? composeScene(composition, { overrides, content })
@@ -39,6 +46,7 @@ export function Scene({ composition, overrides, content, style, ...rest }) {
     <SceneRenderer
       composition={data}
       style={{ ...THEME_VARS, ...style }}
+      sanitizeSvg={sanitizeSvg}
       {...rest}
     />
   )

package/src/utils/index.js

@@ -146,8 +146,15 @@ export function cn(...inputs) {
   return twMerge(clsx(inputs))
 }
 
+const REFERENCES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: '\u00a0' }
+
 /**
- * Strip HTML tags from a string
+ * Strip HTML tags from a string — the plain text of a parser string.
+ *
+ * semantic-parser escapes the text it puts into its strings (`a<b` arrives as
+ * `a&lt;b`), so the plain text decodes the references as well as dropping the
+ * tags, in the browser and on the server alike.
+ *
  * @param {string} html - HTML string
  * @returns {string} Plain text
  */
@@ -160,8 +167,15 @@ export function stripTags(html) {
     return doc.body.textContent || ''
   }
 
-  // Fallback: simple regex (less accurate but works in Node)
-  return html.replace(/<[^>]*>/g, '')
+  // Fallback (no DOM — the server): drop the tags, then decode the references
+  // a serializer writes. ⛔ Until 2026-10-14 it only dropped the tags.
+  return html
+    .replace(/<[^>]*>/g, '')
+    .replace(/&(#[xX][0-9a-fA-F]+|#[0-9]+|[a-zA-Z]+);/g, (match, ref) => {
+      if (ref[0] !== '#') return REFERENCES[ref] ?? match
+      const code = ref[1] === 'x' || ref[1] === 'X' ? parseInt(ref.slice(2), 16) : parseInt(ref.slice(1), 10)
+      return code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : match
+    })
 }
 
 // URL predicates live in url.js so href.js can use them without importing