tosijs-styled-editor 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -7,6 +7,73 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-09-26
+
+### Security
+
+- **0.5.1's fix was incomplete: `reviseWith()` could still emit live HTML.**
+  The guard that strips `<` and `>` from `changeAuthor` was applied at the four
+  write sites in the component and missed the fifth, `mark()` in
+  `src/changes.ts` — which is exactly what `reviseWith()` and the exported
+  `applyRevision()` go through. So the LLM-proofreading path, documented public
+  API, still broke a display name out of a raw-text element and put an
+  `<img onerror>` into `editor.value`. Reproduced end to end through the public
+  `value` setter and `reviseWith()`, with no host cooperation beyond wiring
+  `changeAuthor.name` to a profile name.
+
+  The guard now lives in `src/changes.ts` beside the only code that writes those
+  attributes, and every writer shares it. **A guard belongs at the layer every
+  writer shares, not at the addresses where the bug was first noticed** — which
+  is precisely the mistake 0.5.1 made.
+
+  **Upgrade from 0.5.1 as well as from 0.5.0** if you use `trackChanges` or
+  `reviseWith`. `SECURITY.md`'s statement in 0.5.1 was true of typing and
+  deletion and false of revision.
+
+## [0.5.1] - 2026-09-26
+
+### Security
+
+- **An author's display name could break out of a raw-text element and become
+  live HTML.** HTML attribute serialization escapes `&` and `"` but **never
+  `<`**, and `style`, `xmp`, `title`, `textarea`, `noembed`, `noframes` and
+  `plaintext` re-parse their contents as raw text — so a `changeAuthor.name`
+  containing `</style><img src=x onerror=…>`, written into a change mark inside
+  one of those elements, terminated the element and the remainder parsed as
+  markup. `editor.value` then carried a real `<img onerror>`.
+
+  Nothing external triggers the re-parse: `value` is also the undo stack, so a
+  single undo does it in the same session, and `internals.setFormValue` hands it
+  to every other reader. Reachable without host cooperation — `tosijs-kilpi`
+  drops `style`/`script`/`iframe` but keeps `xmp`/`textarea`/`title`/`noembed`/
+  `noframes`/`plaintext`, so a collaborator can paste one — and the host need
+  only have wired `changeAuthor.name` to a profile name, which is what that
+  field is for.
+
+  `<` and `>` are now stripped from `changeAuthor.id` and `.name` at every write
+  site. Stripping rather than escaping: no escape survives attribute
+  serialization into a raw-text element. Affects 0.5.0 only, and only with
+  `trackChanges` enabled.
+
+  **Still true, and not a vulnerability:** tracked edits inside a raw-text
+  element are a bad idea regardless — a caret marker left in a `<style>` block
+  round-trips into literal CSS text with no attacker involved. Keeping the
+  editor's own marks out of those elements is tracked in `TODO.md`. See
+  `SECURITY.md`.
+
+### Changed
+
+- The build no longer passes `--incremental` to `tsc`, so no
+  `dist/tsconfig.tsbuildinfo` is produced. An incremental build into a wiped
+  `dist/` can emit nothing at all the second time, which disqualifies a build
+  that has to reproduce for the publish workflow.
+
+### Added
+
+- `.github/workflows/publish.yml` — OIDC trusted publishing with npm staged
+  publishing. CI can only *stage*; the maintainer's 2FA approval on npmjs.com is
+  what publishes, and it works from a phone.
+
 ## [0.5.0] - 2026-09-21
 
 ### Added

package/SECURITY.md

@@ -30,3 +30,32 @@ and we will find a private channel.
   content are inside your trust boundary and are not filtered.
 - **documents stored before 0.4.4**, which may already contain a pasted payload.
   Setting `value` does not filter, so sanitize your corpus as part of upgrading.
+
+## `changeAuthor` is written into the document
+
+`editor.changeAuthor` (`id` and `name`) is serialized verbatim into
+`data-author` / `data-author-name` on every change mark, so it reaches
+`editor.value`, the form value and every undo snapshot. It is host-supplied and
+inside your trust boundary — but "the host wired it to a profile name" is the
+ordinary case, so the editor does not trust it: `<` and `>` are stripped at the
+seam (fully fixed in 0.5.2 — 0.5.0 is affected, and **0.5.1 is still affected
+through `reviseWith()`**, whose write site the first fix missed).
+
+They have to be stripped rather than escaped. HTML attribute serialization
+escapes `&` and `"` and **never `<`**, and `style`, `xmp`, `title`, `textarea`,
+`noembed`, `noframes` and `plaintext` re-parse their contents as raw text — so a
+`</style>` inside an attribute value written into one of those terminates the
+element and everything after it parses as markup. Nothing external triggers the
+re-parse: `value` is also the undo stack, so a single undo does it in the same
+session.
+
+Two consequences worth knowing:
+
+- **A display name is not a place to put markup**, and it comes back with its
+  angle brackets removed rather than escaped. There is no escape that survives
+  attribute serialization into a raw-text element.
+- **Tracked edits inside a raw-text element remain a bad idea.** With no
+  attacker at all, a caret marker left inside a `<style>` block round-trips into
+  literal CSS text. Keeping the editor's own marks out of those elements is
+  tracked as an open item; until it lands, do not point this editor at documents
+  whose `<style>`/`<xmp>` content is meant to survive editing.

package/dist/changes.d.ts

@@ -63,6 +63,26 @@ export declare class TosiIns extends HTMLElement {
 export declare class TosiDel extends HTMLElement {
 }
 export declare function defineChanges(): void;
+/**
+ * An attribute value that cannot break out of the element it is written into.
+ *
+ * HTML attribute serialization escapes `&` and `"` and **never `<`**. Inside a
+ * raw-text or RCDATA element — `style`, `xmp`, `title`, `textarea`, `noembed`,
+ * `noframes`, `plaintext` — the contents re-parse as text, so a `</style>` in
+ * an attribute value terminates the element and everything after it parses as
+ * markup, and `editor.value` then carries live HTML.
+ *
+ * This lives HERE, next to the only code that writes these attributes, because
+ * the first version of the fix lived in the component and covered four of the
+ * five write sites. The fifth was `mark()` below — on the public `reviseWith()`
+ * path — so 0.5.1 shipped as the fix for this and was still exploitable
+ * through it. A guard belongs at the layer every writer shares, not at the
+ * addresses where the bug was first noticed.
+ *
+ * Stripping, not escaping: no escape survives attribute serialization into a
+ * raw-text element.
+ */
+export declare function safeAttributeValue(value: string): string;
 /** Every tracked change in a root, in document order. */
 export declare function changesIn(root: Element): TrackedChange[];
 /**