u2ui 1.5.12 → 1.5.13

package/js/rte/src/sanitize/README.md

@@ -13,7 +13,8 @@ repairs editable document shape.
 - `elements`: element names the security policy can accept;
 - `attributes`: global (`*`) and per-element attribute names;
 - `protocols`: per-element rules for URL attributes;
-- `drop`: element names that `narrow()` removes with their content;
+- `drop`: element names that `narrow()` removes with their content, before it
+  asks `skip` — no later stage may be left holding them;
 - `comments` and `dataAttributes`: explicit booleans, both false by default.
 
 An element outside `elements` keeps its content — dropping it would lose text the

package/js/rte/src/sanitize/policy.js

@@ -85,6 +85,8 @@ export class SanitizePolicy {
     // `skip` leaves an element to a later stage. Structural repair already
     // removes what the content model rejects, and it does so knowing that
     // dissolving a block into inline content needs a line break to survive.
+    // A `drop` element is not that kind of question — no later stage may keep
+    // its content — so it goes before `skip` is asked.
     //
     // `alias` names an equivalent for an element that is not allowed. Dropping
     // `<b>` would lose the emphasis it carries, so a strict list can still keep
@@ -96,15 +98,14 @@ export class SanitizePolicy {
             : this.elements.filter(name => elements.includes(name));
         const changed = [];
         for (const element of descendants(root).reverse()) {
-            if (preserve?.has(element)) continue;
-            if (!element.parentNode || skip?.(element)) continue;
+            if (preserve?.has(element) || !element.parentNode) continue;
             if (this.drop.includes(element.localName)) {
                 if (map) map.remove(element);
                 else element.remove();
                 changed.push(element);
                 continue;
             }
-            if (allowed.includes(element.localName)) continue;
+            if (skip?.(element) || allowed.includes(element.localName)) continue;
             const equivalent = alias?.[element.localName];
             if (equivalent && allowed.includes(equivalent)) {
                 const replacement = element.ownerDocument.createElement(equivalent);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "u2ui",
-  "version": "1.5.12",
+  "version": "1.5.13",
   "description": "HTML Advanced: More Capabilities, Same Feel, Same Simplicity",
   "keywords": ["web-components","pattern-library","component-library","ui-toolkit","design-system"],
   "author": "Tobias Buschor",