twbs / bootstrap / 31458638094

94%

main: 96%

push

github

Sanitize HTML icon options in Chips and NavOverflow (#42805)

* Sanitize HTML icon options in Chips and NavOverflow

dismissIcon, moreIcon, and [data-bs-overflow-icon] markup were inserted
via innerHTML without going through the sanitizer. moreText and
menuPlacement were also interpolated into HTML string templates.

Route icon HTML through a dedicated DefaultIconAllowlist, insert
moreText with textContent, and build the NavOverflow toggle with DOM
APIs so those values cannot break out of their slots.

* Raise the minified JS budgets by a quarter kilobyte

The icon allowlist and sanitizer calls in Chips and NavOverflow push the
gzipped min builds a few dozen bytes over the previous caps.

* Update sanitizer section for clarity on HTML rendering

Clarified the explanation of components that can render or accept HTML, emphasizing the use of the built-in content sanitizer to prevent XSS attacks.

* Add viewbox to the cspell dictionary

The icon allowlist uses the lowercased SVG attribute name that the
sanitizer matches on, so cspell flagged it as unknown.

* Tighten DefaultIconAllowlist after review feedback

Document that viewbox is lowercased on purpose for attribute matching,
and drop <use> so icon HTML cannot load external SVG fragments via href.

---------

Co-authored-by: Mark Otto <markdotto@gmail.com>

1751 of 1975 branches covered (88.66%)

Branch coverage included in aggregate %.

22 of 22 new or added lines in 3 files covered. (100.0%)

3611 of 3752 relevant lines covered (96.24%)

119.59 hits per line