CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-09 14:38:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(design): dump hygiene covers CSS URLs, srcdoc, and handlers; dumps persist owner-only; ignore prose treats repo config as evidence

Browse Source 
- The dump script cuts query strings from CSS url() in style attributes,
  <style> nodes, and the inlined stylesheets (signed asset URLs), empties
  srcdoc, and covers background and xlink:href.
- Persisted dumps are chmod 600; MEDIUM redaction findings persist (an
  authenticated page shows emails) and the prose says so; earlier runs'
  dumps are swept before the first dump of a run unless --keep-dom.
- The Aside dump prose asks for `'` in a pasted URL to be percent-encoded
  (a bare single quote would end the script) and never to paste an unread
  URL.
- Repo-config ignores are evidence, not settled decisions, in /review,
  /ship, and design-review's probe prose; the scan JSON's text fields are
  named as untrusted.
- design-html's skeleton ceiling is re-measured (54,545); ship goldens
  refreshed for the checklist prose.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-09-08 18:33:22 +00:00
co-authored by Claude Fable 5.1
parent cb9ba7a3e2
commit fb8c64b20c
13 changed files with 42 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/dom-dump-script.ts
+10 -5
View File
@@ -37,7 +37,9 @@
// stripped) so the report can say so once. <template> and <noscript>
// subtrees (invisible to the querySelectorAll walk) and inline on*
// handlers are removed; cross-origin <link> nodes leave the clone too,
// so the file handed to the engine names no remote stylesheet.
// so the file handed to the engine names no remote stylesheet. CSS url()
// query strings (signed asset URLs) are cut in style attributes, <style>
// nodes, and the inlined sheets; srcdoc is emptied.
export const DOM_DUMP_SCRIPT = String.raw`() => {
const root = document.documentElement.cloneNode(true);
const head = root.querySelector("head") || root;
@@ -58,20 +60,21 @@ export const DOM_DUMP_SCRIPT = String.raw`() => {
}
});
const dataUrl = new RegExp("url\\((\"?)data:[^)]{1024,}\\)", "g");
const cssQuery = new RegExp("url\\(\\s*([\"\u0027]?)([^\u0027\")?#]*)[?#][^\u0027\")]*\\1\\s*\\)", "g");
const cleanCss = (t) => t.replace(dataUrl, "url(data:,gstack-stripped)").replace(cssQuery, "url($1$2$1)");
if (inlined.length) {
const style = document.createElement("style");
style.setAttribute("data-gstack-dom-css", "");
const rgb = new RegExp("rgb\\((\\d+), (\\d+), (\\d+)\\)", "g");
const hex = (n) => Number(n).toString(16).padStart(2, "0");
style.textContent = inlined.join("\n")
.replace(dataUrl, "url(data:,gstack-stripped)")
style.textContent = cleanCss(inlined.join("\n"))
.replace(rgb, (m, r, g, b) => "#" + hex(r) + hex(g) + hex(b));
head.appendChild(style);
}
for (const el of Array.from(root.querySelectorAll("style"))) {
if (el.getAttribute("data-gstack-dom-css") === null && el.textContent) el.textContent = el.textContent.replace(dataUrl, "url(data:,gstack-stripped)");
if (el.getAttribute("data-gstack-dom-css") === null && el.textContent) el.textContent = cleanCss(el.textContent);
}
const urlAttrs = ["href", "src", "poster", "action", "formaction", "data", "ping", "cite"];
const urlAttrs = ["href", "src", "poster", "action", "formaction", "data", "ping", "cite", "background", "xlink:href"];
const cutQuery = (v) => v.split("?")[0].split("#")[0];
let scripts = 0;
for (const el of Array.from(root.querySelectorAll("script"))) {
@@ -84,6 +87,8 @@ export const DOM_DUMP_SCRIPT = String.raw`() => {
const name = attr.name;
const value = attr.value;
if (name.indexOf("on") === 0) el.removeAttribute(name);
else if (name === "srcdoc") el.setAttribute(name, "");
else if (name === "style") el.setAttribute(name, cleanCss(value));
else if (name === "value" && (el.nodeName === "INPUT" || el.nodeName === "TEXTAREA")) el.setAttribute(name, "");
else if ((name === "value" || name.indexOf("data-") === 0) && value.length > 32) el.setAttribute(name, "");
else if (name === "content" && el.nodeName === "META" && el.getAttribute("name") !== "viewport") el.setAttribute(name, "");
lib/dom-dump.js
+7 -4
View File
@@ -18,20 +18,21 @@
}
});
const dataUrl = new RegExp("url\\((\"?)data:[^)]{1024,}\\)", "g");
const cssQuery = new RegExp("url\\(\\s*([\"\u0027]?)([^\u0027\")?#]*)[?#][^\u0027\")]*\\1\\s*\\)", "g");
const cleanCss = (t) => t.replace(dataUrl, "url(data:,gstack-stripped)").replace(cssQuery, "url($1$2$1)");
if (inlined.length) {
const style = document.createElement("style");
style.setAttribute("data-gstack-dom-css", "");
const rgb = new RegExp("rgb\\((\\d+), (\\d+), (\\d+)\\)", "g");
const hex = (n) => Number(n).toString(16).padStart(2, "0");
style.textContent = inlined.join("\n")
.replace(dataUrl, "url(data:,gstack-stripped)")
style.textContent = cleanCss(inlined.join("\n"))
.replace(rgb, (m, r, g, b) => "#" + hex(r) + hex(g) + hex(b));
head.appendChild(style);
}
for (const el of Array.from(root.querySelectorAll("style"))) {
if (el.getAttribute("data-gstack-dom-css") === null && el.textContent) el.textContent = el.textContent.replace(dataUrl, "url(data:,gstack-stripped)");
if (el.getAttribute("data-gstack-dom-css") === null && el.textContent) el.textContent = cleanCss(el.textContent);
}
const urlAttrs = ["href", "src", "poster", "action", "formaction", "data", "ping", "cite"];
const urlAttrs = ["href", "src", "poster", "action", "formaction", "data", "ping", "cite", "background", "xlink:href"];
const cutQuery = (v) => v.split("?")[0].split("#")[0];
let scripts = 0;
for (const el of Array.from(root.querySelectorAll("script"))) {
@@ -44,6 +45,8 @@
const name = attr.name;
const value = attr.value;
if (name.indexOf("on") === 0) el.removeAttribute(name);
else if (name === "srcdoc") el.setAttribute(name, "");
else if (name === "style") el.setAttribute(name, cleanCss(value));
else if (name === "value" && (el.nodeName === "INPUT" || el.nodeName === "TEXTAREA")) el.setAttribute(name, "");
else if ((name === "value" || name.indexOf("data-") === 0) && value.length > 32) el.setAttribute(name, "");
else if (name === "content" && el.nodeName === "META" && el.getAttribute("name") !== "viewport") el.setAttribute(name, "");