mirror of https://github.com/garrytan/gstack.git
8049d0b4ac
<svg><image href=https://…> and <use xlink:href=…> survived the gate (only
javascript: schemes were stripped from svg hrefs), and bare-string
image-set("https://…" 1x) dodged the url()-shaped neutralizer. Remote
svg hrefs rewrite to '#' (entity-decode-aware, unclosed-svg smuggle
closed) and remote image-set args neutralize to url(#). Local fragments,
local image-set, and plain <a> links pinned intact. 12 new rows, red-first.
|
||
|---|---|---|
| .. | ||
| src | ||
| test | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||