mirror of https://github.com/garrytan/gstack.git
8049d0b4ac
<svg><image href=https://…> and <use xlink:href=…> survived the gate (only
javascript: schemes were stripped from svg hrefs), and bare-string
image-set("https://…" 1x) dodged the url()-shaped neutralizer. Remote
svg hrefs rewrite to '#' (entity-decode-aware, unclosed-svg smuggle
closed) and remote image-set args neutralize to url(#). Local fragments,
local image-set, and plain <a> links pinned intact. 12 new rows, red-first.
|
||
|---|---|---|
| .. | ||
| e2e | ||
| fixtures | ||
| browseClient.test.ts | ||
| coverage-gaps.test.ts | ||
| diagram-prepass.test.ts | ||
| image-policy.test.ts | ||
| pdftotext.test.ts | ||
| render-offline-sanitize.test.ts | ||
| render.test.ts | ||