coreui / coreui-pro / 33270146420

93%

main: 94%

push

github

fix(sanitizer): block data: and vbscript: URIs outside safe media data URLs (#978)

* fix(sanitizer): block data: and vbscript: URIs outside safe media data URLs

URI attributes passing sanitization accepted any data: payload, including
data:text/html, which executes script when navigated. The safe-URL pattern
now rejects data: and vbscript: schemes outright, and a separate pattern
readmits only base64-encoded image, video and audio data URLs (SVG excluded,
as it can embed script).

The extra pattern puts coreui.esm.js 50 B over its bundlewatch ceiling —
raised 113.25KB -> 113.5KB.

* chore: raise minified JS bundlewatch ceilings to the post-merge sizes

The floating-labels, delegated-tooltip and trigger-typing merges each fit
their ceilings alone; their sum leaves coreui.bundle.min.js 130 B and
coreui.min.js 20 B over. 79.75KB -> 80KB, 73.75KB -> 74KB.

4742 of 5341 branches covered (88.78%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

9030 of 9453 relevant lines covered (95.53%)

389.73 hits per line