ext/hyperframes
2
0
Fork 0
mirror of https://github.com/heygen-com/hyperframes.git synced 2026-09-10 22:20:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(core): sanitize rich text on the way into a composition (#3141)

Browse Source 
* feat(core): sanitize rich text on the way into a composition

Studio's patch vocabulary was inline-style, attribute, html-attribute and
text-content. text-content assigns textContent, and the text-field model
escapes markup on the way out and refuses a change in child structure, so a
styled span had no route into a composition file.

Adds a rich-text operation with one, guarded by a single sanitizer called on
both ends of the trip: in the browser so the preview shows what will be
saved, and on the server because that is where the file is written. Tags and
style properties are a small allowlist, and an unexpected tag loses its
formatting rather than its words. Spans an edit adds get their ids in the
same write, so a follow-up write cannot race it.

No UI yet — this is the persistence contract the editor is built on.

* fix(core): document and test the sanitizer boundary

* fix(core): harden rich text sanitizer traversal
This commit is contained in:
Miguel Ángel
2026-08-11 02:03:47 -04:00
committed by GitHub
parent fceb376551
commit 636dc042a7
8 changed files with 731 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/studio/src/utils/sourcePatcher.ts
+5 -1
View File
@@ -87,7 +87,11 @@ function splitInlineStyleDeclarations(style: string): string[] {
}
export interface PatchOperation {
type: "inline-style" | "attribute" | "text-content" | "html-attribute";
// `rich-text` is the only member that carries markup. It is deliberately
// separate from `text-content`, whose contract is "this value is text": the
// design panel and every other caller rely on that, and widening it would
// have turned all of them into markup sinks at once.
type: "inline-style" | "attribute" | "text-content" | "html-attribute" | "rich-text";
property: string;
value: string | null;
childSelector?: string;