From e078f1f6fa0e1854dfe2cc4a9ec660c02c94de27 Mon Sep 17 00:00:00 2001 From: "G.Ambatte" Date: Wed, 15 Jul 2026 21:25:28 +1200 Subject: [PATCH 1/4] Change safeHTML attribute check --- client/homebrew/brewRenderer/safeHTML.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/client/homebrew/brewRenderer/safeHTML.js b/client/homebrew/brewRenderer/safeHTML.js index d9438b663..ca2e59d5f 100644 --- a/client/homebrew/brewRenderer/safeHTML.js +++ b/client/homebrew/brewRenderer/safeHTML.js @@ -32,12 +32,12 @@ function safeHTML(htmlString) { return; } // Check remaining elements for blacklisted attributes - for (const attribute of element.attributes){ + [...element.attributes].forEach((attribute)=>{ if(blacklistAttrs.some((test)=>{return test(attribute);})) { - element.removeAttribute(attribute.localName); - break; + element.removeAttribute(attribute.name); + return; }; - }; + }); }); return div.innerHTML; From b49252f3337054918ebc4723c254df4a9b36c7e1 Mon Sep 17 00:00:00 2001 From: "G.Ambatte" Date: Sun, 19 Jul 2026 12:45:53 +1200 Subject: [PATCH 2/4] Update safeHTML tests --- tests/html/safeHTML.test.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/html/safeHTML.test.js b/tests/html/safeHTML.test.js index 0b5b4c169..71ab668ba 100644 --- a/tests/html/safeHTML.test.js +++ b/tests/html/safeHTML.test.js @@ -43,6 +43,12 @@ test('Javascript via inline event handler - onMouseOver', function() { expect(rendered).toBe('
Hover over me
'); }); +test('Javascript via multiple inline event handlers - onClick + onMouseOver', function() { + const source = `
Hover over or Click me
`; + const rendered = safeHTML(source); + expect(rendered).toBe('
Hover over or Click me
'); +}); + test('Javascript via data attribute', function() { const source = `
Test
`; const rendered = safeHTML(source); From 702fa6fe5c1ad9deb531cf08b9a93b7f3b2c5910 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Losada=20Hern=C3=A1ndez?= Date: Sun, 26 Jul 2026 20:44:50 +0200 Subject: [PATCH 3/4] simple fix --- client/components/codeEditor/codeEditor.jsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/components/codeEditor/codeEditor.jsx b/client/components/codeEditor/codeEditor.jsx index c5cf669bd..25bf4f88e 100644 --- a/client/components/codeEditor/codeEditor.jsx +++ b/client/components/codeEditor/codeEditor.jsx @@ -308,7 +308,7 @@ const CodeEditor = forwardRef( view.dispatch({ effects : themeCompartment.reconfigure(themeExtension), }); - }, [editorTheme]); + }, [editorTheme, tab]); useEffect(()=>{ //rebuild syntax highlight when changing tab or renderer From 45ea33307321aa09579708a72dc4e28f8afd0f7b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 03:23:41 +0000 Subject: [PATCH 4/4] Bump the prod-dependencies group across 1 directory with 3 updates Bumps the prod-dependencies group with 3 updates in the / directory: [@codemirror/view](https://github.com/codemirror/view), [less](https://github.com/less/less.js) and [mongoose](https://github.com/Automattic/mongoose). Updates `@codemirror/view` from 6.43.6 to 6.43.7 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `less` from 4.8.0 to 4.8.1 - [Release notes](https://github.com/less/less.js/releases) - [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/less/less.js/compare/v4.8.0...v4.8.1) Updates `mongoose` from 9.8.0 to 9.9.0 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](https://github.com/Automattic/mongoose/compare/9.8.0...9.9.0) --- updated-dependencies: - dependency-name: "@codemirror/view" dependency-version: 6.43.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-dependencies - dependency-name: less dependency-version: 4.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-dependencies - dependency-name: mongoose dependency-version: 9.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-dependencies ... Signed-off-by: dependabot[bot] --- package-lock.json | 24 ++++++++++++------------ package.json | 6 +++--- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/package-lock.json b/package-lock.json index 7687faa24..8a63bae96 100644 --- a/package-lock.json +++ b/package-lock.json @@ -25,7 +25,7 @@ "@codemirror/language-data": "^6.5.2", "@codemirror/search": "^6.6.0", "@codemirror/state": "^6.6.0", - "@codemirror/view": "^6.43.1", + "@codemirror/view": "^6.43.7", "@dmsnell/diff-match-patch": "^1.1.0", "@googleapis/drive": "^20.2.0", "@lezer/highlight": "^1.2.3", @@ -49,7 +49,7 @@ "idb-keyval": "^6.2.5", "js-yaml": "^4.2.0", "jwt-simple": "^0.5.6", - "less": "^4.6.4", + "less": "^4.8.1", "lodash": "^4.18.1", "marked": "15.0.12", "marked-alignment-paragraphs": "^1.0.0", @@ -63,7 +63,7 @@ "marked-variables": "^1.0.5", "markedLegacy": "npm:marked@^0.3.19", "moment": "^2.30.1", - "mongoose": "^9.7.0", + "mongoose": "^9.9.0", "nanoid": "5.1.11", "nconf": "^0.13.0", "node": "^25.9.0", @@ -2546,9 +2546,9 @@ "license": "MIT" }, "node_modules/@codemirror/view": { - "version": "6.43.6", - "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.6.tgz", - "integrity": "sha512-EVunGSYN1wz1p75WY1s3Xg7t3i8Yol0kGZGizNdX9BUFgMFILYVe8/u6EVpo7Ff5PwbZuILb4QAq7IZoKzIEQA==", + "version": "6.43.7", + "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.7.tgz", + "integrity": "sha512-FZsExxkoxnAN+d9TgqXLg5g4A1oQwzX9WlkOT5i2PKkcW7xx3Bmu0vs90g6fo9Mpdsb/l96dnAraQ8932aO4/g==", "license": "MIT", "dependencies": { "@codemirror/state": "^6.7.0", @@ -9748,9 +9748,9 @@ } }, "node_modules/less": { - "version": "4.8.0", - "resolved": "https://registry.npmjs.org/less/-/less-4.8.0.tgz", - "integrity": "sha512-7Y7DJBMbsW29UGjOG6NGvxQEx71AaDcrryBwYCMaFwn0kj8FkSueKN9r9WexVOetKEhXh38kL++WJncfkEpS+g==", + "version": "4.8.1", + "resolved": "https://registry.npmjs.org/less/-/less-4.8.1.tgz", + "integrity": "sha512-jQ3lRIo1aUtiWVYXZ7mk4+V4BjCGswF3IxTLJ+4RUta8ZiHh8lhkig2G8dya2eCcyR1dYUvzuV46EkJN8PSwww==", "license": "Apache-2.0", "dependencies": { "copy-anything": "^3.0.5", @@ -10540,9 +10540,9 @@ } }, "node_modules/mongoose": { - "version": "9.8.0", - "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-9.8.0.tgz", - "integrity": "sha512-PDGx3XACxrBQyWf4YT+5s1Xsx19x84UWGlRVIza4i9RG6qKjGcoG7odotT6uquR6YoaDMTZ6ZZc/jMXLrNPyyA==", + "version": "9.9.0", + "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-9.9.0.tgz", + "integrity": "sha512-xtBH8CU5oRK16F14rC8/KlRHeuPGP+w/URjDdwHV0oyN7otVuqglLje1FePX9+SaSBGj0/QiM65Tg86R7iNbPg==", "license": "MIT", "dependencies": { "@standard-schema/spec": "^1.1.0", diff --git a/package.json b/package.json index 35153c73b..f3e753c50 100644 --- a/package.json +++ b/package.json @@ -101,7 +101,7 @@ "@codemirror/language-data": "^6.5.2", "@codemirror/search": "^6.6.0", "@codemirror/state": "^6.6.0", - "@codemirror/view": "^6.43.1", + "@codemirror/view": "^6.43.7", "@dmsnell/diff-match-patch": "^1.1.0", "@googleapis/drive": "^20.2.0", "@lezer/highlight": "^1.2.3", @@ -125,7 +125,7 @@ "idb-keyval": "^6.2.5", "js-yaml": "^4.2.0", "jwt-simple": "^0.5.6", - "less": "^4.6.4", + "less": "^4.8.1", "lodash": "^4.18.1", "marked": "15.0.12", "marked-alignment-paragraphs": "^1.0.0", @@ -139,7 +139,7 @@ "marked-variables": "^1.0.5", "markedLegacy": "npm:marked@^0.3.19", "moment": "^2.30.1", - "mongoose": "^9.7.0", + "mongoose": "^9.9.0", "nanoid": "5.1.11", "nconf": "^0.13.0", "node": "^25.9.0",