Jakub Zych
c1d767f0f8
- displayHtml uses a dedicated DOMPurify 3.4.16 instance: EDITOR_TAGS, href only on <a> through isAllowedLink, DROPPED elements go with their content - string in, string out: parsed into DOMPurify's inert document, nothing adopted into the live document before binding - fails closed (empty string) unless isSupported and a fixed canary hold - Vitest browser mode in Playwright Chromium (npm run test:browser) covers the clobbering vectors, off-origin form, iframe, meta refresh, links and the inert parse; happy-dom keeps engine-independent assertions
45 lines
1.1 KiB
JSON
45 lines
1.1 KiB
JSON
{
|
|
"name": "summercms-admin",
|
|
"private": true,
|
|
"type": "module",
|
|
"engines": {
|
|
"node": ">=22.6"
|
|
},
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vue-tsc --noEmit && vite build",
|
|
"typecheck": "vue-tsc --noEmit",
|
|
"test": "vitest run",
|
|
"test:browser": "vitest run --config vitest.browser.config.ts",
|
|
"gen:api": "openapi-typescript openapi/admin.json -o src/api/schema.d.ts"
|
|
},
|
|
"dependencies": {
|
|
"@fontsource/dm-mono": "5.3.0",
|
|
"@fontsource/dm-sans": "5.3.0",
|
|
"@internationalized/date": "3.12.4",
|
|
"@lucide/vue": "1.17.0",
|
|
"@tiptap/core": "3.31.4",
|
|
"@tiptap/pm": "3.31.4",
|
|
"@tiptap/starter-kit": "3.31.4",
|
|
"dompurify": "3.4.16",
|
|
"openapi-fetch": "0.17.0",
|
|
"reka-ui": "2.9.10",
|
|
"vue": "3.5.35",
|
|
"vue-router": "5.1.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/vite": "4.3.0",
|
|
"@vitejs/plugin-vue": "6.0.8",
|
|
"@vitest/browser": "3.2.7",
|
|
"@vue/test-utils": "2.4.11",
|
|
"happy-dom": "20.11.6",
|
|
"openapi-typescript": "7.13.0",
|
|
"playwright": "1.60.0",
|
|
"tailwindcss": "4.3.0",
|
|
"typescript": "5.9.3",
|
|
"vite": "7.3.5",
|
|
"vitest": "3.2.7",
|
|
"vue-tsc": "3.3.11"
|
|
}
|
|
}
|