golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(scripts): allow the sanitized markdown preview binding in raw-HTML gates

Browse Source 
- check-phase10, 12.1, 12.2 and 14.2.1 drop only the exact
  MarkdownField.vue line binding sanitizedHtml (server-rendered by
  cabana.RenderMarkdown); every other raw-HTML sink is still refused
This commit is contained in:
Jakub Zych
2026-10-06 20:58:45 +02:00
parent a0116dfbb9
commit 27711b7c21
4 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
scripts/check-phase14.2.1.sh
View File

@@ -323,7 +323,9 @@ run_forbidden() {
echo "refuse: consuming-application name in framework docs: $hits" >&2
bad=1
fi
hits="$(cd "$ROOT/admin/src" && grep -RInE 'v-html=|innerHTML|outerHTML|insertAdjacentHTML' . || true)"
# The markdown preview binds only the HTML POST /markdown/preview answers (cabana.RenderMarkdown); every other raw-HTML sink is still refused.
hits="$(cd "$ROOT/admin/src" && grep -RInE 'v-html=|innerHTML|outerHTML|insertAdjacentHTML' . |
grep -vE '^\./components/form/fields/MarkdownField\.vue:[0-9]+:[[:space:]]*v-html="sanitizedHtml"[[:space:]]*$' || true)"
if [[ -n "$hits" ]]; then
echo "refuse: raw-HTML sink in admin/src: $hits" >&2
bad=1