tosijs-styled-editor 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-09-26
+
+### Security
+
+- **0.5.1's fix was incomplete: `reviseWith()` could still emit live HTML.**
+  The guard that strips `<` and `>` from `changeAuthor` was applied at the four
+  write sites in the component and missed the fifth, `mark()` in
+  `src/changes.ts` — which is exactly what `reviseWith()` and the exported
+  `applyRevision()` go through. So the LLM-proofreading path, documented public
+  API, still broke a display name out of a raw-text element and put an
+  `<img onerror>` into `editor.value`. Reproduced end to end through the public
+  `value` setter and `reviseWith()`, with no host cooperation beyond wiring
+  `changeAuthor.name` to a profile name.
+
+  The guard now lives in `src/changes.ts` beside the only code that writes those
+  attributes, and every writer shares it. **A guard belongs at the layer every
+  writer shares, not at the addresses where the bug was first noticed** — which
+  is precisely the mistake 0.5.1 made.
+
+  **Upgrade from 0.5.1 as well as from 0.5.0** if you use `trackChanges` or
+  `reviseWith`. `SECURITY.md`'s statement in 0.5.1 was true of typing and
+  deletion and false of revision.
+
 ## [0.5.1] - 2026-09-26
 
 ### Security

package/SECURITY.md

@@ -38,7 +38,8 @@ and we will find a private channel.
 `editor.value`, the form value and every undo snapshot. It is host-supplied and
 inside your trust boundary — but "the host wired it to a profile name" is the
 ordinary case, so the editor does not trust it: `<` and `>` are stripped at the
-seam (fixed in 0.5.1; 0.5.0 is affected).
+seam (fully fixed in 0.5.2 — 0.5.0 is affected, and **0.5.1 is still affected
+through `reviseWith()`**, whose write site the first fix missed).
 
 They have to be stripped rather than escaped. HTML attribute serialization
 escapes `&` and `"` and **never `<`**, and `style`, `xmp`, `title`, `textarea`,

package/dist/changes.d.ts

@@ -63,6 +63,26 @@ export declare class TosiIns extends HTMLElement {
 export declare class TosiDel extends HTMLElement {
 }
 export declare function defineChanges(): void;
+/**
+ * An attribute value that cannot break out of the element it is written into.
+ *
+ * HTML attribute serialization escapes `&` and `"` and **never `<`**. Inside a
+ * raw-text or RCDATA element — `style`, `xmp`, `title`, `textarea`, `noembed`,
+ * `noframes`, `plaintext` — the contents re-parse as text, so a `</style>` in
+ * an attribute value terminates the element and everything after it parses as
+ * markup, and `editor.value` then carries live HTML.
+ *
+ * This lives HERE, next to the only code that writes these attributes, because
+ * the first version of the fix lived in the component and covered four of the
+ * five write sites. The fifth was `mark()` below — on the public `reviseWith()`
+ * path — so 0.5.1 shipped as the fix for this and was still exploitable
+ * through it. A guard belongs at the layer every writer shares, not at the
+ * addresses where the bug was first noticed.
+ *
+ * Stripping, not escaping: no escape survives attribute serialization into a
+ * raw-text element.
+ */
+export declare function safeAttributeValue(value: string): string;
 /** Every tracked change in a root, in document order. */
 export declare function changesIn(root: Element): TrackedChange[];
 /**