arcane-os 0.16.0 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.16.1
+
+- Remove raw script elements and inline event-handler attributes at the
+  `markdown-document` insertion boundary, including nested template contents.
+  Preserve literal fenced and inline code examples, formatting, navigation,
+  and asynchronous document loading. This targeted reader correction does not
+  provide a general-purpose HTML sanitizer or alter other Markdown consumers.
+
 ## 0.16.0
 
 - Make mail hosting domain-based: use the current browser origin by default,

package/README.md

@@ -19,7 +19,7 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.16.0` SDK contract. Applications pin one exact npm
+This checkout defines the `0.16.1` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into application
 artifacts.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/runtime/arcane/components/markdown-document.html

@@ -616,8 +616,8 @@
             return true;
         }
 
-        // MD.safeRendered owns Markdown rendering. The detached template keeps
-        // source-relative links and images coherent before insertion.
+        // MD renders Markdown; the detached fragment removes active script
+        // markup and resolves source-relative assets before insertion.
         const safeRendered=new MD(markdown).safeRendered;
         const fragment=renderedMarkdownFragment(safeRendered,sourceURL);
         const meaningful=Boolean(
@@ -648,6 +648,27 @@
         const template=document.createElement('template');
         template.innerHTML=html;
 
+        // Code examples are text nodes, so their literal markup stays intact.
+        // Visit nested template contents too, without reparsing cleaned HTML.
+        const pendingFragments=[template.content];
+        while(pendingFragments.length){
+            const fragment=pendingFragments.pop();
+            for(const element of fragment.querySelectorAll('*')){
+                if(element.localName.toLowerCase()==='script'){
+                    element.remove();
+                    continue;
+                }
+                for(const attribute of Array.from(element.attributes)){
+                    if(attribute.name.toLowerCase().startsWith('on')){
+                        element.removeAttributeNode(attribute);
+                    }
+                }
+                if(element.localName==='template'&&element.content){
+                    pendingFragments.push(element.content);
+                }
+            }
+        }
+
         for(const link of template.content.querySelectorAll('a[href]')){
             const originalHref=link.getAttribute('href')||'';
             const policy=markdownDocumentLinkPolicy(originalHref,sourceURL,pageOrigin);