coreui / coreui-pro / 28760480938

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(Chip): sanitize selected/remove icons before injection (#594)

selectedIcon and removeIcon (settable via data-coreui-* attributes) were
written to innerHTML with no sanitizer, unlike rating.js. Add sanitize /
allowList / sanitizeFn options (SVG-aware allow list), route both icons
through sanitizeHtml, and strip sanitize/allowList/sanitizeFn from data
attributes so the sanitizer can't be disabled from markup.

Coverage Stats

2788 of 3078 branches covered (90.58%)

Branch coverage included in aggregate %.

13 of 13 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

7177 of 7453 relevant lines covered (96.3%)

785.5 hits per line