Danny Avila f9927f0168 📑 fix: Sanitize Markdown Artifacts (#12249) ... * 🛡️ fix: Sanitize markdown artifact rendering to prevent stored XSS Replace marked-react with react-markdown + remark-gfm for artifact markdown preview. react-markdown's skipHtml strips raw HTML tags, and a urlTransform guard blocks javascript: and data: protocol links. * fix: Update useArtifactProps test to expect react-markdown dependencies * fix: Harden markdown artifact sanitization - Convert isSafeUrl from denylist to allowlist (http, https, mailto, tel plus relative/anchor URLs); unknown protocols are now fail-closed - Add remark-breaks to restore single-newline-to-<br> behavior that was silently dropped when replacing marked-react - Export isSafeUrl from the host module and add 16 direct unit tests covering allowed protocols, blocked schemes (javascript, data, blob, vbscript, file, custom), edge cases (empty, whitespace, mixed case) - Hoist remarkPlugins to a module-level constant to avoid per-render array allocation in the generated Sandpack component - Fix import order in generated template (shortest to longest per AGENTS.md) and remove pre-existing trailing whitespace * fix: Return null for blocked URLs, add sync-guard comments and test - urlTransform returns null (not '') for blocked URLs so react-markdown omits the href/src attribute entirely instead of producing <a href=""> - Hoist urlTransform to module-level constant alongside remarkPlugins - Add JSDoc sync-guard comments tying the exported isSafeUrl to its template-string mirror, so future maintainers know to update both - Add synchronization test asserting the embedded isSafeUrl contains the same allowlist set, URL parsing, and relative-path checks as the export		2026-03-15 18:40:42 -04:00
..
public	🎨 chore: Update Agent Tool with new SVG assets (#12065)	2026-03-04 09:28:19 -05:00
scripts
src	📑 fix: Sanitize Markdown Artifacts (#12249)	2026-03-15 18:40:42 -04:00
test
babel.config.cjs
check_updates.sh
index.html
jest.config.cjs	✨ v0.8.3 (#12161)	2026-03-09 15:19:57 -04:00
nginx.conf
package.json	✨ v0.8.3 (#12161)	2026-03-09 15:19:57 -04:00
postcss.config.cjs
tailwind.config.cjs	♿ style(MCP): Enhance dialog accessibility and styling consistency (#11585)	2026-02-11 22:08:40 -05:00
tsconfig.json
vite.config.ts	⚡ chore: bump vite to v7 (#12031)	2026-03-03 10:25:10 -05:00