tosijs-styled-editor 0.4.4 → 0.4.5

package/CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.5] - 2026-09-17
+
+### Added
+
+- **`SECURITY.md`**, with the one thing it needs to say: a sanitizer bypass
+  belongs to [`tosijs-kilpi`](https://github.com/tonioloewald/kilpi/issues),
+  because that is where the code lives. The README's security section now points
+  at kilpi's policy as authoritative rather than restating it — a copy of a
+  policy drifts from the policy, which is the same failure the extraction
+  removed from the code.
+- **`NOTICE`**, for the three Apache-2.0 works the drop-in `dist/index.js`
+  bundles.
+
+### Changed
+
+- **Sanitization moved to [`tosijs-kilpi`](https://github.com/tonioloewald/kilpi)**,
+  the same code extracted as a standalone library so it is not maintained in two
+  places. No API change: `sanitizeInPlace` and `isSafeNavigationUrl` are still
+  exported from this package, `editor.sanitize` still works the same way, and
+  behaviour is identical.
+
+  The reason it matters is not tidiness. When the sanitizer briefly existed
+  twice, a URL-normalization fix reached one copy and not the other — recorded
+  as M1 in the 0.4.4 review. Across two repositories that drift would not even
+  appear in a diff. kilpi carries DOMPurify's published 223-fixture corpus as a
+  hard publish gate, which this package could not run on its own.
+
+  `tosijs-kilpi` is a real dependency (this package's first — tosijs and
+  tosijs-ui remain peers), at `^1.0.0`. kilpi went 1.0.0 for that reason alone:
+  `^0.1.0` resolves to `>=0.1.0 <0.2.0`, so a 0.2.0 security fix would have
+  reached no installed consumer, and for a dependency that *is* the XSS defence
+  a range that blocks propagation is a defect in itself. It is external in `dist/module.js`, so a consumer who
+  also depends on it directly gets one copy, and bundled into `dist/index.js`,
+  which assumes no installs.
+
+
 ## [0.4.4] - 2026-09-16
 
 First release since 0.4.3 to reach npm. 0.4.4 and 0.4.5 were versioned in the

package/NOTICE

@@ -0,0 +1,16 @@
+tosijs-styled-editor
+Copyright 2026 Tonio Loewald
+
+The drop-in build (dist/index.js) bundles the following Apache-2.0 works:
+
+  tosijs          — Copyright 2026 Tonio Loewald
+  tosijs-ui       — Copyright 2026 Tonio Loewald
+  tosijs-kilpi    — Copyright 2026 Tonio Loewald
+                    https://github.com/tonioloewald/kilpi
+
+dist/module.js leaves all three external and bundles none of them.
+
+tosijs-kilpi's verification corpus is vendored from DOMPurify
+(Copyright (c) 2015 Mario Heiderich, MPL-2.0 OR Apache-2.0). That corpus is a
+test fixture in kilpi's repository and is not distributed in kilpi's package or
+in this one, so no DOMPurify material is redistributed here.

package/README.md

@@ -63,7 +63,13 @@ Live site and docs: <https://editor.tosijs.net>
 npm install tosijs-styled-editor
 ```
 
-Peer dependencies: `tosijs`, `tosijs-ui`
+**Peer dependencies** (you install these): `tosijs`, `tosijs-ui`
+
+**Runtime dependency** (installed automatically):
+[`tosijs-kilpi`](https://github.com/tonioloewald/kilpi) — the sanitizer applied
+to pasted and dropped content. It has no dependencies of its own and is about
+0.8 kB gzipped. The drop-in `dist/index.js` build bundles it; the ESM build
+leaves it external so you get one copy if you also depend on it directly.
 
 ## Usage
 
@@ -121,32 +127,39 @@ The caret is an `<input>` element, so mobile browsers show their keyboard automa
 
 ## Security: what is sanitized, and what is not
 
-Replacing `contentEditable` also means replacing the sanitization the browser
-was doing on your behalf. As of 0.4.4:
+Replacing `contentEditable` also means replacing the sanitization the browser was
+doing on your behalf.
 
 **Sanitized** — content arriving from outside the document, which is the path an
-attacker controls:
-
-- **paste** and **drop** (both go through one shared choke point)
-- inline event handlers (`onerror`, `onload`, …) are removed
-- `script`, `iframe`, `object`, `embed`, `link`, `meta`, `base`, `style`,
-  `form` and the SVG animation elements are removed — in **any** namespace, so
-  `<svg><script>` and `<svg><style>` are caught too
-- `href`/`src`/`xlink:href` are scheme-checked: `http(s)`, `mailto`, `tel` and
-  relative URLs are kept, `javascript:` is dropped, and `data:` is allowed only
-  for raster images (never for a link, never `data:image/svg+xml`)
-- ordinary formatting and **unregistered custom elements survive** — plugin
-  markup is content, not a threat
+attacker controls: **paste** and **drop**, both through one shared choke point.
+
+The filtering itself is [`tosijs-kilpi`](https://github.com/tonioloewald/kilpi),
+and **[its SECURITY.md is the authoritative policy](https://github.com/tonioloewald/kilpi/blob/main/SECURITY.md)** —
+read it before relying on this. It is deliberately not restated here, because a
+copy of a policy drifts from the policy. The one thing worth repeating, because
+it is a trade rather than a detail:
+
+> kilpi is a **denylist** for elements and attributes and an **allowlist** for URL
+> schemes. That is why unknown elements survive — your plugin markup round-trips
+> intact — and it is also why an element that becomes dangerous in a future
+> browser, and that kilpi has never heard of, would pass through. If protection
+> from the not-yet-known matters more to you than preserving unknown markup, use
+> DOMPurify instead (see the hook below).
 
 **NOT sanitized** — content you supply, which is inside your own trust boundary:
 
 - `editor.value = html`
 - initial light-DOM content
 
+**If you are upgrading from 0.4.3 or earlier:** documents your users created
+before 0.4.4 may already contain a payload that was pasted in, and this component
+cannot fix that for you — setting `value` does not filter. Sanitize your stored
+corpus as part of the upgrade.
+
 **Using a different sanitizer.** `editor.sanitize` is the hook — it receives a
 detached element and mutates it:
 
-```js
+```javascript
 editor.sanitize = (root) => {
   DOMPurify.sanitize(root, {
     IN_PLACE: true,
@@ -161,14 +174,13 @@ editor.sanitize = (root) => {
 
 It takes an element rather than an HTML string on purpose: a string signature
 would force a serialize-and-reparse round trip, and that round trip is where
-mutation XSS lives. Note the `CUSTOM_ELEMENT_HANDLING` block — DOMPurify
-unwraps unknown custom elements by default, which would discard plugin markup
-the built-in sanitizer preserves.
-
-**If you are upgrading from 0.4.3 or earlier, read this:** documents your users
-created before 0.4.4 may already contain a payload that was pasted in, and the
-component cannot fix that for you — setting `value` does not filter. Sanitize
-your stored corpus as part of the upgrade.
+mutation XSS lives. Note the `CUSTOM_ELEMENT_HANDLING` block — DOMPurify unwraps
+unknown custom elements by default, which would discard plugin markup kilpi
+preserves.
+
+**Reporting a vulnerability.** If it is in the sanitizer, file it against
+[kilpi](https://github.com/tonioloewald/kilpi/issues) — that is where the code
+lives. Anything else, [this repository](https://github.com/tonioloewald/tosijs-editor/issues).
 
 ## Keyboard Behavior
 

package/SECURITY.md

@@ -0,0 +1,32 @@
+# Security
+
+## Reporting
+
+- **A sanitizer bypass** — pasted or dropped content that reaches the document
+  still able to execute — belongs to
+  [`tosijs-kilpi`](https://github.com/tonioloewald/kilpi/issues). That is where
+  the filtering code lives; this package only calls it.
+- **Anything else** — [this repository's
+  issues](https://github.com/tonioloewald/tosijs-editor/issues).
+
+If you would rather not disclose publicly first, open an issue with no details
+and we will find a private channel.
+
+## What this package is responsible for
+
+- applying sanitization at the **paste and drop choke point**, before any node
+  enters the document (`insertTransfer`)
+- the `editor.sanitize` hook, so a host can substitute its own sanitizer
+- the two URL guards this package owns: `setLink`, and following a link on
+  Ctrl/Cmd-click
+
+## What it is NOT responsible for
+
+- **the sanitization policy itself** — that is kilpi's, and
+  [kilpi's SECURITY.md](https://github.com/tonioloewald/kilpi/blob/main/SECURITY.md)
+  is authoritative. It is deliberately not restated here, because a copy of a
+  policy drifts from the policy.
+- **content the host supplies**: `editor.value = html` and initial light-DOM
+  content are inside your trust boundary and are not filtered.
+- **documents stored before 0.4.4**, which may already contain a pasted payload.
+  Setting `value` does not filter, so sanitize your corpus as part of upgrading.

package/dist/dom-utils.d.ts

@@ -84,26 +84,15 @@ export declare function caretGeometryAt(marker: Element, root: Element): {
     height: number;
 } | null;
 /**
- * Strip executable content from a subtree, IN PLACE.
+ * Sanitization lives in `tosijs-kilpi` — the same code, extracted so it is not
+ * maintained in two places.
  *
- * The editor replaced `contentEditable` but not the sanitization the browser
- * was doing on its behalf: pasted and dropped HTML is written into the live
- * document, and from there into `value`, `internals.setFormValue` and every
- * undo snapshot — so an unsanitized payload is stored, re-served, and re-fired
- * on undo. Must run BEFORE any node enters the document.
+ * It was duplicated briefly, and that is exactly the shape that produced review
+ * finding M1 of the 0.4.4 cycle: one URL-normalization defect fixed in one of
+ * two copies, silently leaving the other. Across two repositories that drift
+ * would not even be visible in a diff.
  *
- * This is deliberately a denylist for elements and an allowlist for URL
- * schemes: unknown ELEMENTS are content (including a plugin's custom elements,
- * which must survive — see EXTENSIBILITY.md), whereas unknown SCHEMES are not.
+ * Re-exported here so the editor's public API is unchanged and every call site
+ * keeps importing from `./dom-utils`.
  */
-export declare function sanitizeInPlace(root: Element | DocumentFragment): void;
-/**
- * Is this URL safe to NAVIGATE to, or to write into an href?
- *
- * Stricter than `isSafeUrl`: that one allows raster `data:image/*` because an
- * `<img src>` may legitimately carry one, while a link must never — so this
- * rejects every `data:` URL. Both must normalize identically, or the stricter
- * check is the one that gets bypassed: `da&#9;ta:image/png;…` passed here while
- * `data:image/png;…` was correctly rejected.
- */
-export declare function isSafeNavigationUrl(value: string): boolean;
+export { sanitizeInPlace, isSafeNavigationUrl } from 'tosijs-kilpi';