coreui / coreui-pro / 36699251031

96%

main: 94%

push

github

fix(Combobox): sanitize the caret icon (#1472)

* fix(Combobox): sanitize the caret icon

Combobox inserted caretIcon with insertAdjacentHTML as given, so an icon read from data-coreui-caret-icon kept its event handlers: <img src=x onerror=...> ran its script in Chromium. The icon now goes through sanitizeByConfig like the icons of Chip, NumberInput, PasswordInput and the pickers, and Combobox defaults allowList to SVGAllowlist as they do, so the default SVG caret survives; the labels rendered from items are sanitized against the same list. The icon is parsed in a template and its first element becomes the caret, so an icon of which nothing survives draws no caret instead of marking the toggle's last child as one. sanitize: false keeps the icon as given. The options table names the new default.

* fix(Combobox): sanitize the caret against the SVG allow list only

The first version sanitized the caret with the Combobox's own allowList and moved that default to SVGAllowlist. That changed what html labels accept, split Combobox from ListBox, Autocomplete and MultiSelect, and a page that passed its own allowList for the labels lost the default caret. The caret is now sanitized the way MultiSelect and Autocomplete sanitize their picker icon, with { ...config, allowList: SVGAllowlist }, and allowList keeps its DefaultAllowlist default for the labels.

The icon's last element becomes the caret and every node of the icon is inserted, as before, so an icon with a visually hidden text in front of the SVG keeps the SVG as its caret. SVGAllowlist now allows xlink:href on use, the sprite form the icons docs use, which the caret rendered before it was sanitized; the URL check still removes a javascript: reference there.

* chore: raise the coreui.esm.js budget for the caret sanitizer

Sanitizing the Combobox caret against SVGAllowlist adds 48 B gzip to coreui.esm.js (zlib level 9, base 77e61d7b2 against this branch), and the base already sat at the 147.75 KB ceilin... (continued)

6278 of 6833 branches covered (91.88%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 1 file covered. (100.0%)

11346 of 11663 relevant lines covered (97.28%)

864.71 hits per line