fix(security): harden prop and URL validation against bypasses - #373

Merged

farnabaz merged 18 commits into

mainfrom

fix/security-prop-url-validation

Aug 25, 2026

Commits on Aug 20, 2026

fix(comark): escape attribute values in HTML serialization
atinux
committed
77f0b67
fix(comark): use prototype-safe handler lookups in the stringifier
atinux
committed
b153904
fix(comark): sanitize footnote labels used in href/id attributes
atinux
committed
d7df943
fix(comark): restrict code fence language to safe characters
atinux
committed
9da7473
fix(security): reject framework HTML sink props from markdown
atinux
committed
f244813
fix(security): hold the as prop to the same tag filters
atinux
committed
25b82ca
fix(security): decode HTML entities before URL validation
atinux
committed
3ae22e7
fix(security): resolve scheme-relative URLs and match prefix allowlists by origin
atinux
committed
8bca76c
fix(security): validate the JSON-decoded form of :href/:src bindings
atinux
committed
2276dc4
docs(security): document sink-prop filtering, as-prop checks, and URL hardening
atinux
committed
1cb4c5f
fix(comark): block unsafe protocols in binding-resolved URLs at render time
atinux
committed
bd2b84b

Commits on Aug 21, 2026

Commits on Aug 25, 2026

Merge branch 'main' into fix/security-prop-url-validation
farnabaz
committed
879977c
test: update bundle size snapshot
github-actions[bot]
authored
4975780