spyne 0.24.0 → 0.26.0

package/src/spyne/utils/safe-clone.js

@@ -15,7 +15,7 @@ const getPropType = (prp) => {
   return type
 }
 
-const cmsDataReviveNestedProxyObj = (proxyObj, proxyReviverMethod) => {
+const cmsDataReviveNestedProxyObj = (proxyObj = {}, proxyReviverMethod) => {
   const { __proxy__proxyName } = proxyObj
 
   if (__proxy__proxyName === undefined) {
@@ -50,7 +50,7 @@ const cmsDataReviveNestedProxyObj = (proxyObj, proxyReviverMethod) => {
   return rootObj
 }
 
-export const safeClone = function(o) {
+const reviveIfProxy = (o = {}) => {
   const { __proxy__proxyName } = o
   if (__proxy__proxyName !== undefined) {
     const proxyReviverMethod = SpyneAppProperties.getProxyReviver(__proxy__proxyName)
@@ -58,6 +58,132 @@ export const safeClone = function(o) {
       return cmsDataReviveNestedProxyObj(o, proxyReviverMethod)
     }
   }
+  return undefined
+}
+
+/**
+ *
+ * Deep, proxy-preserving clone. Unlike safeClone — which only revives when the
+ * ROOT object is a proxy — this walks plain containers (objects and arrays)
+ * and revives any nested proxy it finds, so wrappers that hold proxied data
+ * (e.g. channel payloads, pageData containers) survive cloning intact.
+ * Functions are passed through by reference; cycles are guarded.
+ *
+ * @param {Object|Array} o
+ * @returns A writable copy in which every nested proxy has been revived
+ */
+export const safeCloneDeep = function(o, seen = new WeakSet()) {
+  if (o === null || typeof o !== 'object') {
+    return o
+  }
+
+  const revived = reviveIfProxy(o)
+  if (revived !== undefined) {
+    return revived
+  }
+
+  if (seen.has(o)) {
+    return o
+  }
+  seen.add(o)
+
+  if (Array.isArray(o)) {
+    return o.map(item => safeCloneDeep(item, seen))
+  }
+
+  const out = {}
+  Object.entries(o).forEach(([key, val]) => {
+    out[key] = safeCloneDeep(val, seen)
+  })
+  return out
+}
+
+/**
+ * Re-wraps a derived array with the SOURCE array's proxy metadata via the
+ * registered reviver. Native filter/reject/map keep element identity but
+ * return a plain array — losing the array-level proxy that string-item
+ * template loops (e.g. {{#titles}}) rely on for __cms__dataId / keyFor
+ * lookups. In production (no proxies) this is a single undefined check.
+ *
+ * Note: the reviver rebuilds its key/value map from the derived contents, so
+ * value-keyed lookups survive while original index positions shift.
+ */
+const rewrapArrayFromSource = (sourceArr, resultArr) => {
+  const proxyName = sourceArr?.__proxy__proxyName
+  if (proxyName === undefined) {
+    return resultArr
+  }
+  const proxyReviverMethod = SpyneAppProperties.getProxyReviver(proxyName)
+  if (typeof proxyReviverMethod !== 'function') {
+    return resultArr
+  }
+  return proxyReviverMethod(resultArr, sourceArr.__proxy__props)
+}
+
+/**
+ *
+ * Proxy-preserving Array.prototype.filter: elements keep their identity
+ * (native behavior) AND the returned array keeps the source array's proxy
+ * metadata. Use in place of ramda filter / arr.filter on CMS data.
+ */
+export const safeFilter = function(arr, predicate) {
+  return rewrapArrayFromSource(arr, arr.filter(predicate))
+}
+
+/**
+ *
+ * Proxy-preserving reject — inverse of safeFilter.
+ */
+export const safeReject = function(arr, predicate) {
+  return rewrapArrayFromSource(arr, arr.filter((item, i) => predicate(item, i) === false))
+}
+
+/**
+ *
+ * Proxy-preserving Array.prototype.map with an augment-in-place contract:
+ * proxied elements arrive in the callback as WRITABLE revived copies, so
+ * `safeMap(stories, s => { s.type = 'story'; return s; })` is safe by
+ * construction (no silent live-proxy write traps). Plain elements pass by
+ * reference exactly like native map, so production cost matches native.
+ * A callback that builds an entirely new object per element still strips
+ * that element's identity — there is nothing left to preserve.
+ */
+export const safeMap = function(arr, mapFn) {
+  const result = arr.map((item, i) => {
+    const isProxied = item !== null && typeof item === 'object' && item.__proxy__proxyName !== undefined
+    return mapFn(isProxied ? safeCloneDeep(item) : item, i)
+  })
+  return rewrapArrayFromSource(arr, result)
+}
+
+/**
+ *
+ * Revive-then-augment. Live CMS proxies silently ignore writes of new keys,
+ * so properties cannot be attached to them directly. This returns a writable,
+ * proxy-preserved copy of o with the given props applied — the sanctioned way
+ * to add view or route properties to CMS-proxied data.
+ *
+ * @param {Object|Array} o
+ * @param {Object} propsObj properties to assign onto the revived copy
+ * @returns A writable proxy-preserved copy carrying the extra props
+ */
+export const safeAugment = function(o, propsObj = {}) {
+  const target = safeCloneDeep(o)
+  Object.entries(propsObj).forEach(([key, val]) => {
+    target[key] = val
+  })
+  return target
+}
+
+export const safeClone = function(o, deep = false) {
+  const revived = reviveIfProxy(o)
+  if (revived !== undefined) {
+    return revived
+  }
+
+  if (deep === true) {
+    return safeCloneDeep(o)
+  }
 
   const isArr = is(Array)
   const isObj = is(Object)

package/src/spyne/utils/sanitize-data.js

@@ -1,5 +1,6 @@
 // src/utils/sanitize-data.js
 import DOMPurify from 'dompurify'
+import { spyneWarn } from './spyne-warn.js'
 import { SpyneAppProperties } from './spyne-app-properties.js'
 
 let _sanitizeData
@@ -23,6 +24,56 @@ const normalizeUriForCheck = (val) => String(val).replace(/[\u0000-\u0020]/g, ''
 
 const isSafeUri = (val) => SAFE_URI_REGEXP.test(normalizeUriForCheck(val))
 
+/* ---------------------------------------------
+ * Custom elements
+ *
+ * The framework's own custom elements (spyne-*) are first-party output —
+ * the CMS proxy wraps editable content in <spyne-cms-item> etc. — and are
+ * admitted in every mode. They are inert without their defining plugin
+ * and the attribute check below only admits data-* on them.
+ *
+ * Additional elements register via allowCustomElements() (additive only;
+ * names must contain a hyphen per the custom-element spec, so built-in
+ * tags like script or iframe can never be admitted through this path)
+ * or via config.customElements at SpyneApp.init.
+ * ------------------------------------------- */
+const SPYNE_CUSTOM_ELEMENT_RE = /^spyne-[a-z][a-z0-9-]*$/i
+
+const allowedCustomElementPatterns = []
+
+const allowCustomElements = (elements = []) => {
+  const arr = Array.isArray(elements) ? elements : [elements]
+
+  arr.forEach((entry) => {
+    if (entry instanceof RegExp) {
+      allowedCustomElementPatterns.push(entry)
+      return
+    }
+
+    const name = String(entry).toLowerCase()
+    if (/^[a-z][a-z0-9]*-[a-z0-9-]+$/.test(name) !== true) {
+      spyneWarn(`SPYNE WARNING: "${entry}" is not a valid custom element name (a hyphen is required) and was not added to the sanitizer allowlist.`)
+      return
+    }
+
+    allowedCustomElementPatterns.push(name)
+  })
+}
+
+const customElementTagCheck = (tagName) => {
+  if (SPYNE_CUSTOM_ELEMENT_RE.test(tagName)) return true
+
+  return allowedCustomElementPatterns.some(p =>
+    p instanceof RegExp ? p.test(tagName) : p === tagName
+  )
+}
+
+const CUSTOM_ELEMENT_HANDLING = {
+  tagNameCheck: customElementTagCheck,
+  attributeNameCheck: /^data-[a-z0-9-]+$/i,
+  allowCustomizedBuiltInElements: false
+}
+
 /* ---------------------------------------------
  * Mode configurations
  * ------------------------------------------- */
@@ -42,14 +93,16 @@ const SAFE_FOR_RICH_TEXT = {
   ALLOW_DATA_ATTR: true,
   FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover', 'onfocus', 'onblur', 'onchange'],
   FORBID_TAGS: ['script', 'object', 'embed', 'meta'],
-  ALLOWED_URI_REGEXP: SAFE_URI_REGEXP
+  ALLOWED_URI_REGEXP: SAFE_URI_REGEXP,
+  CUSTOM_ELEMENT_HANDLING
 }
 
 const SAFE_FOR_APP = {
   FORBID_TAGS: ['script', 'iframe', 'object', 'embed', 'form', 'input', 'button', 'link', 'meta'],
   FORBID_ATTR: ['onerror', 'onload', 'onclick', 'onmouseover', 'onfocus', 'onblur', 'onchange'],
   ALLOW_DATA_ATTR: false,
-  ALLOWED_URI_REGEXP: SAFE_URI_REGEXP
+  ALLOWED_URI_REGEXP: SAFE_URI_REGEXP,
+  CUSTOM_ELEMENT_HANDLING
 }
 
 /* ---------------------------------------------
@@ -136,7 +189,7 @@ const addIframeHardeningHook = () => {
 
     const src = node.getAttribute('src') || ''
     if (src !== '' && isAllowedIframeSrc(src) !== true) {
-      console.warn(`SPYNE WARNING: iframe src "${src}" was removed by the iframe policy (same-origin, https, or an allowed origin is required).`)
+      spyneWarn(`SPYNE WARNING: iframe src "${src}" was removed by the iframe policy (same-origin, https, or an allowed origin is required).`)
       node.removeAttribute('src')
     }
 
@@ -147,6 +200,117 @@ const addIframeHardeningHook = () => {
   })
 }
 
+/* ---------------------------------------------
+ * Anchor policy
+ *
+ * Configured via config.anchors at SpyneApp.init:
+ *   allowTarget    — true (default) admits target on dynamic anchors in
+ *                    every mode; the hook validates values and forces
+ *                    noopener. false strips target everywhere.
+ *   addNoopener    — true (default) forces rel="noopener noreferrer"
+ *                    onto target="_blank" anchors.
+ *   allowedDomains — [] (any destination the URI scheme policy allows) |
+ *                    ['https://github.com', ...] restricts cross-origin
+ *                    hrefs to the listed origins. Same-origin, relative,
+ *                    mailto: and tel: hrefs are always allowed.
+ *
+ * A per-call override can be passed as opts.anchors to sanitizeData.
+ * The legacy top-level allowTargetAttr and addNoopener config keys are
+ * honored as fallbacks.
+ * ------------------------------------------- */
+// target accepts any browsing-context name; these are the keywords that
+// stay in the same context and therefore carry no opener risk.
+const SAME_CONTEXT_TARGETS = ['_self', '_parent', '_top']
+
+let configuredAnchorPolicy = { allowTarget: true, addNoopener: true, allowedDomains: [] }
+let activeAnchorPolicy = configuredAnchorPolicy
+
+const resolveAnchorPolicy = (override) => {
+  if (!override) return configuredAnchorPolicy
+  return {
+    allowTarget: override.allowTarget !== undefined ? override.allowTarget === true : configuredAnchorPolicy.allowTarget,
+    addNoopener: override.addNoopener !== undefined ? override.addNoopener === true : configuredAnchorPolicy.addNoopener,
+    allowedDomains: override.allowedDomains !== undefined ? override.allowedDomains : configuredAnchorPolicy.allowedDomains
+  }
+}
+
+const isAllowedAnchorHref = (href, policy = activeAnchorPolicy) => {
+  const normalized = normalizeUriForCheck(href)
+
+  // mailto: and tel: are not domains and always pass.
+  if (/^(mailto|tel):/i.test(normalized)) return true
+
+  let resolved
+  try {
+    resolved = new URL(normalized, window.location.href)
+  } catch (e) {
+    return false
+  }
+
+  // Same-origin links (including relative hrefs) are never restricted.
+  if (resolved.origin === window.location.origin && resolved.origin !== 'null') {
+    return true
+  }
+
+  if (/^https?:$/.test(resolved.protocol) !== true) return false
+
+  const domains = policy.allowedDomains
+  if (!Array.isArray(domains) || domains.length === 0) return true
+
+  return domains.some(d => {
+    try {
+      return new URL(d).origin === resolved.origin
+    } catch (e) {
+      return false
+    }
+  })
+}
+
+const forceNoopenerRel = (el) => {
+  const currentRel = el.getAttribute('rel') || ''
+  const relSet = new Set(currentRel.split(/\s+/).filter(Boolean))
+
+  relSet.add('noopener')
+  relSet.add('noreferrer')
+
+  el.setAttribute('rel', Array.from(relSet).join(' '))
+}
+
+let anchorHookAdded = false
+const addAnchorHardeningHook = () => {
+  if (anchorHookAdded) return
+  anchorHookAdded = true
+
+  DOMPurify.addHook('afterSanitizeAttributes', (node) => {
+    if (!node || typeof node.getAttribute !== 'function') return
+    if (node.tagName !== 'A') return
+
+    const policy = activeAnchorPolicy
+    const href = node.getAttribute('href')
+
+    if (href && policy.allowedDomains.length > 0 && isAllowedAnchorHref(href, policy) !== true) {
+      spyneWarn(`SPYNE WARNING: anchor href "${href}" was removed by the anchor policy (same-origin or an allowed domain is required).`)
+      node.removeAttribute('href')
+    }
+
+    const target = node.getAttribute('target')
+    if (!target) return
+
+    // target without an href serves no purpose.
+    if (policy.allowTarget !== true || !node.getAttribute('href')) {
+      node.removeAttribute('target')
+      return
+    }
+
+    // Any browsing-context name is valid; _blank and named windows both
+    // hand the opened page an opener reference, so noopener applies to
+    // every target except the same-context keywords.
+    if (SAME_CONTEXT_TARGETS.includes(target) !== true && policy.addNoopener === true) {
+      forceNoopenerRel(node)
+    }
+  })
+}
+
 /* ---------------------------------------------
  * Determine sanitization mode
  *
@@ -186,13 +350,27 @@ const buildModeConfig = (mode) => {
     }
   }
 
-  if (mode === 'app' && allowIframe === true) {
-    return {
-      ...base,
-      FORBID_TAGS: base.FORBID_TAGS.filter(t => t !== 'iframe'),
-      ADD_TAGS: ['iframe'],
-      ADD_ATTR: ['sandbox']
+  if (mode === 'app') {
+    const cfg = { ...base }
+    const addAttr = []
+
+    if (allowIframe === true) {
+      cfg.FORBID_TAGS = base.FORBID_TAGS.filter(t => t !== 'iframe')
+      cfg.ADD_TAGS = ['iframe']
+      addAttr.push('sandbox')
+    }
+
+    // DOMPurify strips target by default; re-admit it (with rel) so the
+    // anchor hook can validate values and force noopener instead.
+    if (activeAnchorPolicy.allowTarget === true) {
+      addAttr.push('target', 'rel')
     }
+
+    if (addAttr.length > 0) {
+      cfg.ADD_ATTR = addAttr
+    }
+
+    return cfg
   }
 
   return base
@@ -209,23 +387,37 @@ function makeSanitizeFn(mode = 'app') {
  * ------------------------------------------- */
 const sanitizeDataConfigure = (config = {}) => {
   if (isConfigured) {
-    console.warn('sanitizeData is already configured. Reconfiguration is not allowed.')
+    spyneWarn('sanitizeData is already configured. Reconfiguration is not allowed.')
     return
   }
 
-  const { strict = false, disableSanitize = false, iframes } = config
+  const { strict = false, disableSanitize = false, iframes, customElements, anchors, allowTargetAttr, addNoopener } = config
 
   globalDisable = disableSanitize === true
 
+  if (customElements !== undefined) {
+    allowCustomElements(customElements)
+  }
+
   if (iframes && typeof iframes === 'object') {
     configuredIframePolicy = resolveIframePolicy(iframes)
     activeIframePolicy = configuredIframePolicy
   }
 
+  // config.anchors wins; the legacy top-level allowTargetAttr/addNoopener
+  // keys are honored as fallbacks.
+  configuredAnchorPolicy = resolveAnchorPolicy({
+    allowTarget: anchors?.allowTarget !== undefined ? anchors.allowTarget : allowTargetAttr,
+    addNoopener: anchors?.addNoopener !== undefined ? anchors.addNoopener : addNoopener,
+    allowedDomains: anchors?.allowedDomains
+  })
+  activeAnchorPolicy = configuredAnchorPolicy
+
   if (globalDisable) {
     console.warn('SPYNE SECURITY WARNING: All data sanitization is DISABLED via config.disableSanitize. Do not use this setting in production.')
   } else {
     addIframeHardeningHook()
+    addAnchorHardeningHook()
   }
 
   const processFactory = (mode) => {
@@ -245,19 +437,21 @@ const sanitizeDataConfigure = (config = {}) => {
   }
 
   _sanitizeData = (data, opts = {}) => {
-    const { disableSanitize: callDisable = false, mode, iframes: iframesOverride } = opts
+    const { disableSanitize: callDisable = false, mode, iframes: iframesOverride, anchors: anchorsOverride } = opts
     if (globalDisable || callDisable) return data
 
     const legacyStrict = forceStrict || strict
     const effectiveMode = mode || (legacyStrict ? 'app' : resolveDefaultMode())
 
-    // Sanitization is synchronous, so the per-call iframe policy can be
-    // scoped with a swap-and-restore around the processing pass.
+    // Sanitization is synchronous, so the per-call iframe and anchor
+    // policies can be scoped with a swap-and-restore around the pass.
     activeIframePolicy = resolveIframePolicy(iframesOverride)
+    activeAnchorPolicy = resolveAnchorPolicy(anchorsOverride)
     try {
       return processFactory(effectiveMode)(data)
     } finally {
       activeIframePolicy = configuredIframePolicy
+      activeAnchorPolicy = configuredAnchorPolicy
     }
   }
 
@@ -330,6 +524,16 @@ const sanitizeAttribute = (key, value, tagName) => {
     return { allowed: isAllowedIframeSrc(value, configuredIframePolicy), value }
   }
 
+  // Anchor href follows the anchor policy: safe scheme, plus the
+  // configured domain allowlist for cross-origin destinations.
+  if (tag === 'A' && k === 'href') {
+    if (isSafeUri(value) !== true) return { allowed: false, value }
+    if (configuredAnchorPolicy.allowedDomains.length > 0 && isAllowedAnchorHref(value, configuredAnchorPolicy) !== true) {
+      return { allowed: false, value }
+    }
+    return { allowed: true, value }
+  }
+
   if (URL_ATTRS.includes(k) && isSafeUri(value) !== true) {
     return { allowed: false, value }
   }
@@ -338,16 +542,31 @@ const sanitizeAttribute = (key, value, tagName) => {
 }
 
 /**
- * Applies the configured iframe sandbox policy to an element created
+ * Applies the configured iframe and anchor policies to an element created
  * through the attribute channel (DomElement), mirroring the DOMPurify
- * hook that guards parsed HTML.
+ * hooks that guard parsed HTML.
  */
-const applyIframeHardening = (el) => {
-  if (globalDisable || !el || el.tagName !== 'IFRAME') return el
+const applyElementHardening = (el) => {
+  if (globalDisable || !el) return el
 
-  const { sandbox } = configuredIframePolicy
-  if (sandbox !== false && el.hasAttribute('sandbox') !== true) {
-    el.setAttribute('sandbox', sandbox)
+  if (el.tagName === 'IFRAME') {
+    const { sandbox } = configuredIframePolicy
+    if (sandbox !== false && el.hasAttribute('sandbox') !== true) {
+      el.setAttribute('sandbox', sandbox)
+    }
+  }
+
+  if (el.tagName === 'A') {
+    const policy = configuredAnchorPolicy
+    const target = el.getAttribute('target')
+
+    if (target) {
+      if (policy.allowTarget !== true || !el.getAttribute('href')) {
+        el.removeAttribute('target')
+      } else if (SAME_CONTEXT_TARGETS.includes(target) !== true && policy.addNoopener === true) {
+        forceNoopenerRel(el)
+      }
+    }
   }
 
   return el
@@ -376,7 +595,7 @@ const sanitizeEventTarget = (el, mode) => {
  * config.mode at SpyneApp.init. Retained for backward compatibility.
  * ------------------------------------------- */
 const setSanitizeDataForceStrict = (bool = true) => {
-  console.warn('SPYNE DEPRECATION: setSanitizeDataForceStrict is deprecated. Pass { mode: "app" } to sanitizeData, or set config.mode in SpyneApp.init.')
+  spyneWarn('SPYNE DEPRECATION: setSanitizeDataForceStrict is deprecated. Pass { mode: "app" } to sanitizeData, or set config.mode in SpyneApp.init.')
   forceStrict = !!bool
 }
 
@@ -385,7 +604,9 @@ export {
   sanitizeData,
   sanitizeDataForce,
   sanitizeAttribute,
-  applyIframeHardening,
+  applyElementHardening,
+  allowCustomElements,
+  CUSTOM_ELEMENT_HANDLING as customElementHandling,
   sanitizeEventTarget,
   setSanitizeDataForceStrict
 }

package/src/spyne/utils/sanitize-html.js

@@ -1,4 +1,6 @@
 import DOMPurify from 'dompurify'
+import { spyneWarn } from './spyne-warn.js'
+import { customElementHandling } from './sanitize-data.js'
 
 let _sanitizeHTML
 let isConfigured = false
@@ -17,7 +19,7 @@ let isConfigured = false
  */
 const sanitizeHTMLConfigure = (config = {}) => {
   if (isConfigured) {
-    console.warn('sanitizeHTML is already configured. Reconfiguration is not allowed.')
+    spyneWarn('sanitizeHTML is already configured. Reconfiguration is not allowed.')
     return
   }
 
@@ -26,9 +28,9 @@ const sanitizeHTMLConfigure = (config = {}) => {
     mode = 'app',
     disableSanitize = false,
     allowTargetAttr = true,
-    addNoopener = true,
     debug = false,
-    iframes = {}
+    iframes = {},
+    anchors = {}
   } = config
 
   if (disableSanitize === true) {
@@ -46,6 +48,12 @@ const sanitizeHTMLConfigure = (config = {}) => {
   // is admitted here.
   const allowIframe = iframes.allow !== undefined ? iframes.allow === true : isRichtext
 
+  // config.anchors.allowTarget wins; the legacy top-level allowTargetAttr
+  // key is honored as a fallback. Target values and noopener enforcement
+  // are handled by the anchor hook registered in sanitize-data, which
+  // applies to this layer's sanitization as well.
+  const allowTarget = anchors.allowTarget !== undefined ? anchors.allowTarget === true : allowTargetAttr === true
+
   const domPurifyConfig = {
     RETURN_TRUSTED_TYPE: false,
     ADD_TAGS: [
@@ -53,49 +61,18 @@ const sanitizeHTMLConfigure = (config = {}) => {
       ...(isRichtext ? ['link'] : [])
     ],
     ADD_ATTR: [
-      ...(allowTargetAttr ? ['target'] : []),
+      ...(allowTarget ? ['target', 'rel'] : []),
       ...(allowIframe ? ['sandbox'] : [])
     ],
+    // Admits the framework's spyne-* elements (CMS proxy wrappers) and any
+    // elements registered via allowCustomElements/config.customElements.
+    // The tag check is a closure, so late plugin registration is honored.
+    CUSTOM_ELEMENT_HANDLING: customElementHandling,
     ...(allowIframe !== true && isRichtext ? { FORBID_TAGS: ['iframe'] } : {})
   }
 
   const sanitizeWithPolicy = (html) => DOMPurify.sanitize(html, domPurifyConfig)
 
-  if (allowTargetAttr) {
-    DOMPurify.addHook('afterSanitizeAttributes', (node) => {
-      if (!node || typeof node.getAttribute !== 'function') return
-      if (node.tagName !== 'A') return
-
-      const href = node.getAttribute('href')
-      const target = node.getAttribute('target')
-
-      // remove target on anchors without href
-      if (!href && target) {
-        node.removeAttribute('target')
-        return
-      }
-
-      if (!target) return
-
-      const validTargets = ['_blank', '_self', '_parent', '_top']
-      if (!validTargets.includes(target)) {
-        node.removeAttribute('target')
-        return
-      }
-
-      if (target === '_blank' && addNoopener) {
-        const currentRel = node.getAttribute('rel') || ''
-        const relParts = currentRel.split(/\s+/).filter(Boolean)
-        const relSet = new Set(relParts)
-
-        relSet.add('noopener')
-        relSet.add('noreferrer')
-
-        node.setAttribute('rel', Array.from(relSet).join(' '))
-      }
-    })
-  }
-
   _sanitizeHTML = sanitizeWithPolicy
 
   if (strict === true && window.trustedTypes) {
@@ -110,7 +87,7 @@ const sanitizeHTMLConfigure = (config = {}) => {
         console.log('SPYNE: Trusted Types default policy registered. Note that browser enforcement additionally requires the CSP header: require-trusted-types-for \'script\'.')
       }
     } catch (err) {
-      console.warn('SPYNE WARNING: A Trusted Types "default" policy already exists on this page. Falling back to direct sanitization.', err)
+      spyneWarn('SPYNE WARNING: A Trusted Types "default" policy already exists on this page. Falling back to direct sanitization.', err)
     }
   }
 

package/src/spyne/utils/spyne-app-properties.js

@@ -9,6 +9,8 @@ let _channelsMap
 let _initialized
 let _debug = true
 let _enableCMSProxies = false
+let _cmsRehydrator
+let _cmsLineageWarner
 const _excludeChannelsFromConsole = []
 /* eslint-disable */
 let _linksData
@@ -250,6 +252,34 @@ class SpyneAppPropertiesClass {
     return _proxiesMap.get(proxyName)
   }
 
+  /**
+   * Registers the CMS re-hydration hook consulted by DomElementTemplate when
+   * it receives plain (unproxied) data while CMS proxies are enabled. The
+   * hook receives the template data and returns either revived proxy data
+   * for that content or undefined to decline. Implementations must be cheap
+   * for non-CMS data — ideally a single own-property read before bailing.
+   */
+  registerCmsRehydrator(method) {
+    _cmsRehydrator = method
+  }
+
+  get rehydrateCmsData() {
+    return _cmsRehydrator
+  }
+
+  /**
+   * Registers the debug-mode hook DomElementTemplate calls when data renders
+   * unproxied while CMS proxies are enabled and re-hydration declined —
+   * the lineage reporter that turns silent proxy strips into warnings.
+   */
+  registerCmsLineageWarner(method) {
+    _cmsLineageWarner = method
+  }
+
+  get warnUnproxiedCmsData() {
+    return _cmsLineageWarner
+  }
+
   getPluginConfigByPluginName(pluginName) {
     return _config.plugins[pluginName]
   }