coreui / coreui-pro
95%

Repo Added 17 May 2026 10:15AM UTC

Token xWsYEliUZcsKD8YuHf3HMmjnbcE48xXcC regen

Build 87 Last

Files 46

Badge

Embed ▾

LAST BUILD ON BRANCH main
branch: main

CHANGE BRANCH
x

Reset

Sync Branches

main

chore/bump-astro-docs-0.1.0-beta.12

chore/harden-dependabot

chore/sync-upstream

dependabot/github_actions/github-actions-7e54f4a74d

docs/ai-tools-mcp

docs/mcp-clients

docs/toggle-buttons-spacing

feat/astro-docs

feat/multi-select-hide-select-all-on-search-no-results

feat/multi-select-native-validation

feat/multi-select-select-all-template

fix/ai-tools-links

fix/autocomplete-allow-only-defined-options-click

fix/autocomplete-highlight-xss

fix/broken-doc-links

fix/chip-icon-sanitizer

fix/multi-select-header-snippet

fix/multi-select-update-native-attrs

fix/placeholder-false-label

fix/sanitizer-bypass-config-strings

fix/time-picker-hour-cycle

refactor/multi-select-cleanup

refactor/multi-select-is-option-group

refactor/multi-select-rename-init

refactor/shared-sanitizer-utils

Committed 06 Jul 2026 12:52AM UTC coverage: 94.645% (-0.009%) from 94.654%

Build # 28760966205

Build Type

push

github

Committed by

web-flow

Commit Message

fix(pickers,RangeSlider,Autocomplete): route config strings through the sanitizer (#596)

Several developer-config strings were written to innerHTML while skipping the
component's own sanitizer/escaping:
- RangeSlider tooltip update path (init path already sanitized)
- Autocomplete searchNoResultsLabel (multi-select already used textContent)
- TimePicker / DateRangePicker footer buttons and DateRangePicker ranges keys
- Calendar weekNumbersLabel and navigation aria-label attributes

Sanitize (RangeSlider) or set via textContent / HTML-escape (others) so config
can no longer inject markup.

Coverage Stats

2792 of 3080 branches covered (90.65%)

Branch coverage included in aggregate %.

8 of 8 new or added lines in 4 files covered. (100.0%)

1 existing line in 1 file now uncovered.

7177 of 7453 relevant lines covered (96.3%)

726.07 hits per line

Relevant lines Covered

7453 RELEVANT LINES 7177 COVERED LINES

726.07 HITS PER LINE

Source Files on main

Recent builds

Builds	Branch	Commit	Type	Ran	Committer	Via	Coverage
28760966205	main	fix(pickers,RangeSlider,Autocomplete): route config strings through the sanitizer (#596) Several developer-config strings were written to innerHTML while skipping the component's own sanitizer/escaping: - RangeSlider tooltip update path (init pat...	push	06 Jul 2026 12:54AM UTC	web-flow	github	94.65
28760810335	main	fix(Rating,RangeSlider,Calendar,DateRangePicker): close sanitize bypass via data attributes (#595) _getConfig stripped sanitize/allowList/sanitizeFn from the element's data attributes, but then called _mergeConfigObj(config, this._element), which...	push	06 Jul 2026 12:49AM UTC	web-flow	github	94.65
28760480938	main	fix(Chip): sanitize selected/remove icons before injection (#594) selectedIcon and removeIcon (settable via data-coreui-* attributes) were written to innerHTML with no sanitizer, unlike rating.js. Add sanitize / allowList / sanitizeFn options (SV...	push	06 Jul 2026 12:37AM UTC	web-flow	github	94.63
28759634324	main	fix(Autocomplete): escape option labels in highlight to prevent XSS (#593) Option labels passed to highlightOptionsOnSearch were wrapped in <strong> and written to innerHTML without escaping, so external-search results containing markup (e.g. <im...	push	06 Jul 2026 12:09AM UTC	web-flow	github	94.64
28759335552	main	refactor(util/sanitizer): add shared escapeHtml and SVGAllowlist (#597) Introduce two reusable primitives next to sanitizeHtml/DefaultAllowlist so components stop defining their own copies: - escapeHtml(text) — HTML-escape a string (attributes an...	push	05 Jul 2026 11:58PM UTC	web-flow	github	94.6
28742912559	main	chore: harden dependabot config (groups, cooldown, curated ignores; drop stale v4 label) (#590)	push	05 Jul 2026 01:50PM UTC	web-flow	github	94.6
28710393684	main	chore(docs): bump @coreui/astro-docs to 0.1.0-beta.12 (#589)	push	04 Jul 2026 03:13PM UTC	web-flow	github	94.6
28705240402	main	docs: fix placeholder images rendering "false" as label/text (#588)	push	04 Jul 2026 11:49AM UTC	web-flow	github	94.62
28688342572	main	docs: fix broken internal links (base-relative helpers/accessibility) (#587)	push	03 Jul 2026 11:52PM UTC	web-flow	github	94.63
28683429100	main	docs: fix doubled base path in AI Tools LLMs.txt links (#586)	push	03 Jul 2026 09:09PM UTC	web-flow	github	94.6

See All Builds (87)

Badge your Repo: coreui-pro

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.

Embed ▾

Refresh

coreui / coreui-pro
95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

CHANGE BRANCH
x

Relevant lines Covered

Source Files on main

Recent builds

Badge your Repo: coreui-pro

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

coreui / coreui-pro 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

CHANGE BRANCH x

Relevant lines Covered

Source Files on main

Recent builds

Badge your Repo: coreui-pro

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

coreui / coreui-pro
95%

README BADGES
x

CHANGE BRANCH
x

README BADGES
x