fix(security): sanitize frontmatter, tag selectors and data URLs

fix(security): sanitize frontmatter, tag selectors and data URLscomarkdown/comark #486 · 3 diagrams

◈ Rendered by PR Lens · crafted with ❤️ by the Coldtea team

100%

01 / 05Security plugin now sanitizes frontmatterFrontmatter keys and nested objects are cleaned of scripts, unsafe URLs, and event handlers by default. calls on , removing unsafe paths in +29 −11.
02 / 05Tag selectors as and is now filteredElements using as or is props cannot switch into blocked or disallowed component tags. calls to check dynamic component attributes in +29 −11.
03 / 05sanitizeData added to utilsCallers can clean arbitrary JSON and YAML objects in place using the same rules as props. exports sanitizeData from in +4 −0.
04 / 05data URL checks hardenedNon-image data URLs are rejected across attributes, and data images are barred from links. checks MIME types and protocols in +133 −39.
05 / 05Everything this change touchedThe security plugin, sanitization helpers, renderer checks, docs, and bundle suites.

esc to leave