Skip to content

Batch of bug fixes hardening editor correctness and security#88

Merged
orkhanahmadov merged 1 commit into
mainfrom
bug-fixes
May 15, 2026
Merged

Batch of bug fixes hardening editor correctness and security#88
orkhanahmadov merged 1 commit into
mainfrom
bug-fixes

Conversation

@orkhanahmadov
Copy link
Copy Markdown
Member

@orkhanahmadov orkhanahmadov commented May 15, 2026

  • Link dialog rejects dangerous URL schemes. javascript:, data:, vbscript:, file: (plus case-bypasses like JaVaScRiPt: and whitespace-padded variants) are now dropped at link-insert time. Safe schemes (http, https, mailto, tel, ftp, ftps, sms, xmpp, cid) and # anchors still pass through.
  • v-html content sanitized before render. ParagraphBlock and TitleBlock now scrub <script>/<style>/<iframe>/on* event handlers and unsafe href / src schemes from block.content before binding it to v-html. Closes the XSS path where a malicious or compromised template JSON could execute code on canvas load. TipTap-authored content (the common case) is unaffected.
  • Block duplication regenerates nested IDs. Cloning a table, social, or menu block previously reused identical rows[].id / cells[].id / icons[].id / items[].id from the source, violating the unique-id invariant.
  • Removing a section clears descendant selection. Previously, deleting an ancestor with a child selected left selectedBlockId dangling on the now-orphan id. The full subtree is walked on remove and selection is cleared if any descendant id matches.
  • addBlock / moveBlock validate columnIndex against the section layout. Passing columnIndex: 5 on a "2"-layout section no longer creates phantom columns persisted into JSON; out-of-range indices are rejected and moveBlock leaves the source intact.
  • Media-picker callers guard against post-unmount writes. ImageBlock, ImageToolbar, VideoToolbar, and the custom-block ImageField now check an alive flag after await onRequestMedia(). Closing the editor mid-pick no longer triggers zombie emit("update") / pulse-ref writes on a torn-down component.
  • Keyboard shortcuts scoped to the active editor when two are mounted. Each useEditorCore instance previously installed its own document keydown listener, so a single Cmd+Z fired both editors' undo handlers. The new activeEditorTracker routes shortcuts to the editor the user most recently interacted with (single-editor pages keep the original always-active behavior).
  • MergeTagSuggestion cancels its pending requestAnimationFrame on exit. The reposition-after-paint frame previously ran after the popup tore down, pinning the Vue app and DOM nodes for one frame.
  • useMergeTagField.insertMergeTag no longer emits after the host component unmounts. A scope-dispose flag now gates the post-await requestMergeTag() writes (emit + isEditing + nextTick).
  • useFonts.loadCustomFonts no longer flips isLoaded after dispose. The post-Promise.allSettled write is gated by the same scope-dispose flag.

@orkhanahmadov orkhanahmadov self-assigned this May 15, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

Deploying templatical-cloud-site with  Cloudflare Pages  Cloudflare Pages

Latest commit: 2f089c1
Status: ✅  Deploy successful!
Preview URL: https://82b8a321.templatical-cloud-site.pages.dev
Branch Preview URL: https://bug-fixes.templatical-cloud-site.pages.dev

View logs

@cloudflare-workers-and-pages
Copy link
Copy Markdown

Deploying templatical-playground with  Cloudflare Pages  Cloudflare Pages

Latest commit: 2f089c1
Status: ✅  Deploy successful!
Preview URL: https://8d9bcd3f.templatical-playground.pages.dev
Branch Preview URL: https://bug-fixes.templatical-playground.pages.dev

View logs

@cloudflare-workers-and-pages
Copy link
Copy Markdown

Deploying templatical-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 2f089c1
Status: ✅  Deploy successful!
Preview URL: https://73b205c9.templatical-docs.pages.dev
Branch Preview URL: https://bug-fixes.templatical-docs.pages.dev

View logs

@orkhanahmadov orkhanahmadov merged commit 507c5be into main May 15, 2026
14 checks passed
@orkhanahmadov orkhanahmadov deleted the bug-fixes branch May 15, 2026 07:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant