mirror of https://github.com/garrytan/gstack.git
3f53b9e173
Three live vectors found by the ship review army, all red-first tested: unquoted style attributes skipped the remote-url neutralizer entirely; CSS ident/string escapes (@\69mport, url(\68ttps://…)) defeated the literal-match patterns Chromium happily decodes; and HTML entities in style attribute values (https) decoded to fetchable schemes before CSS parsing. Style-attr values are now entity-decoded in one browser- faithful pass, escape-bearing at-rules and function tokens are dropped fail-closed, and output is re-encoded double-quoted. 21 new test rows. |
||
|---|---|---|
| .. | ||
| e2e | ||
| fixtures | ||
| browseClient.test.ts | ||
| coverage-gaps.test.ts | ||
| diagram-prepass.test.ts | ||
| image-policy.test.ts | ||
| pdftotext.test.ts | ||
| render-offline-sanitize.test.ts | ||
| render.test.ts | ||