Jakub Zych c1d767f0f8 fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16) ...

- displayHtml uses a dedicated DOMPurify 3.4.16 instance: EDITOR_TAGS, href
  only on <a> through isAllowedLink, DROPPED elements go with their content
- string in, string out: parsed into DOMPurify's inert document, nothing
  adopted into the live document before binding
- fails closed (empty string) unless isSupported and a fixed canary hold
- Vitest browser mode in Playwright Chromium (npm run test:browser) covers
  the clobbering vectors, off-origin form, iframe, meta refresh, links and
  the inert parse; happy-dom keeps engine-independent assertions

2026-10-12 20:35:57 +02:00

..

openapi

feat(17-01): tree reorder page and singleton admin controllers

2026-10-12 15:35:43 +02:00

public

fix(admin): add favicon and page-aware titles

2026-10-07 10:39:22 +02:00

src

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00

tests

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00

env.d.ts

feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

2026-09-27 15:21:48 +02:00

index.html

fix(admin): add favicon and page-aware titles

2026-10-07 10:39:22 +02:00

package-lock.json

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00

package.json

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00

tsconfig.json

feat(10-01): serve the embedded admin SPA at backend.uri with cookie login

2026-09-27 15:21:48 +02:00

vite.config.ts

feat(10.1-02): run registered toolbar actions and scope plugin CSS per controller

2026-09-29 02:13:26 +02:00

vitest.browser.config.ts

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00

vitest.config.ts

fix(admin): sanitize the richeditor read-only display with DOMPurify (T-10-16)

2026-10-12 20:35:57 +02:00