Add trusted sanitized fragments for `safeHtml` composition by Copilot · Pull Request #61 · bQuery/bQuery

Copilot · 2026-03-13T11:16:20Z

safeHtml escaped every interpolation, so already-sanitized fragments could not be composed without being rendered as text. This change adds an explicit trusted-content path for sanitized HTML while preserving safeHtml's default escaping behavior.

Security API
- Add branded SanitizedHtml / TrustedHtml types in @bquery/bquery/security
- Change sanitizeHtml() to return SanitizedHtml
- Add trusted() to mark sanitized fragments for verbatim reuse
Template composition
- Update safeHtml to detect trusted(...) interpolations and splice them without re-escaping
- Keep all non-trusted interpolations escaped as before
Public exports
- Re-export trusted, SanitizedHtml, and TrustedHtml from the security entrypoint and full bundle
Docs and examples
- Document the new composition pattern in the security and component guides
Targeted coverage
- Add tests for:
  - default safeHtml escaping
  - composing trusted(sanitizeHtml(...)) inside safeHtml
  - composing nested safeHtml fragments through trusted(...)

Example:

import { safeHtml } from '@bquery/bquery/component';
import { sanitizeHtml, trusted } from '@bquery/bquery/security';

const icon = trusted(sanitizeHtml('<strong onclick="alert(1)">Hi</strong>'));

const result = safeHtml`<div>${icon}<span>${'Save & Close'}</span></div>`;
// => '<div><strong>Hi</strong><span>Save &amp; Close</span></div>'

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot

Pull request overview

Adds a “trusted fragment” mechanism to allow composing already-sanitized markup inside safeHtml templates without double-escaping, while keeping default escaping behavior for all other interpolations.

Changes:

Introduces branded SanitizedHtml / TrustedHtml types and a trusted() helper in the security module.
Updates safeHtml to splice trusted(...) interpolations verbatim and escape everything else.
Adds targeted tests and documentation for trusted fragment composition, plus re-exports via @bquery/bquery/security and full bundle.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/security.test.ts	Adds coverage for `trusted(sanitizeHtml(...))` wrapper behavior.
tests/component.test.ts	Adds coverage for `safeHtml` escaping + trusted fragment composition (including nested `safeHtml`).
src/security/sanitize.ts	Adds branded types and trusted marker implementation; changes `sanitizeHtml` return type to `SanitizedHtml`.
src/security/index.ts	Re-exports `trusted` and the new branded types from the security entrypoint.
src/full.ts	Re-exports `trusted` and branded types from the full bundle entrypoint.
src/component/html.ts	Updates `safeHtml` to detect and splice trusted fragments and escape non-trusted values.
docs/guide/security.md	Documents trusted fragment composition pattern for `safeHtml`.
docs/guide/components.md	Updates component guide examples to mention/use the new trusted composition pattern.

docs/guide/security.md

src/security/sanitize.ts

docs/guide/components.md

src/security/sanitize.ts

Signed-off-by: Jonas Pfalzgraf <info@josunlp.de>

JosunLP · 2026-03-13T21:40:36Z

@copilot apply changes based on the comments in this thread

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot · 2026-03-13T21:46:08Z

@copilot apply changes based on the comments in this thread

Addressed in a235d1f. Updated the misleading SVG examples, clarified the SanitizedHtml documentation so it matches both sanitizeHtml() and safeHtml(), and changed the component guide to demonstrate the intended safeHtml + trusted() composition pattern. No UI changes were involved.

Copilot

Pull request overview

This PR introduces an explicit “trusted fragment” mechanism to allow composing already-sanitized HTML inside safeHtml templates without double-escaping, while preserving safeHtml’s default escaping behavior across the codebase.

Changes:

Add branded SanitizedHtml / TrustedHtml types and a trusted() wrapper in the security module, with updated public exports.
Update safeHtml to return SanitizedHtml and to splice trusted(...) interpolations verbatim (no re-escaping).
Add targeted tests and documentation updates describing the new composition pattern.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`src/security/sanitize.ts`	Introduces `SanitizedHtml`/`TrustedHtml`, updates `sanitizeHtml()` return type, adds `trusted()` + internal helpers.
`src/component/html.ts`	Updates `safeHtml` to return `SanitizedHtml` and support trusted fragment splicing.
`src/security/index.ts`	Re-exports `trusted` and the new branded types from the security entrypoint.
`src/full.ts`	Re-exports `trusted` and branded types from the full/CDN entrypoint.
`tests/security.test.ts`	Adds coverage for `trusted(sanitizeHtml(...))` behavior.
`tests/component.test.ts`	Adds coverage for default escaping and trusted fragment composition in `safeHtml`.
`docs/guide/security.md`	Documents the new trusted-fragment composition pattern.
`docs/guide/components.md`	Updates component guide example to demonstrate `trusted(sanitizeHtml(...))` with `safeHtml`.

docs/guide/security.md

src/component/html.ts

JosunLP · 2026-03-13T21:58:54Z

@copilot apply changes based on the comments in this thread

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot · 2026-03-13T22:02:07Z

@copilot apply changes based on the comments in this thread

Addressed in b699a34. I removed the unsupported @bquery/bquery/security/sanitize guidance from the security guide and corrected the safeHtml JSDoc so the example output and return description match the actual escaping/branding behavior. No UI changes were involved.

Copilot

Pull request overview

Adds an explicit “trusted sanitized fragment” mechanism so safeHtml can compose already-sanitized markup without double-escaping, while keeping default escaping for all non-trusted interpolations.

Changes:

Introduces branded SanitizedHtml / TrustedHtml plus trusted() and internal unwrapping helpers in the security sanitizer module.
Updates safeHtml to splice trusted(...) interpolations verbatim and returns SanitizedHtml.
Re-exports new security APIs/types and adds targeted tests + docs describing the new composition pattern.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/security.test.ts	Adds unit test for `trusted(sanitizeHtml(...))` reuse behavior.
tests/component.test.ts	Adds coverage for `safeHtml` escaping and trusted fragment composition (including nested `safeHtml`).
src/security/sanitize.ts	Adds branded HTML types, `trusted()`, and internal trusted-marker detection/unwrapping; `sanitizeHtml()` now returns `SanitizedHtml`.
src/security/index.ts	Re-exports `trusted` and the new types from the security entrypoint.
src/full.ts	Re-exports `trusted` and types from the full bundle entrypoint.
src/component/html.ts	Updates `safeHtml` to detect trusted markers and return branded `SanitizedHtml`.
docs/guide/security.md	Documents trusted fragment composition with `trusted(sanitizeHtml(...))` inside `safeHtml`.
docs/guide/components.md	Updates component guide example to use `safeHtml` and demonstrate trusted fragment reuse.

src/component/html.ts

JosunLP · 2026-03-13T22:07:44Z

@copilot apply changes based on the comments in this thread

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot · 2026-03-13T22:12:07Z

@copilot apply changes based on the comments in this thread

Addressed in 3fcb0fc. I moved the branded trusted/sanitized HTML helpers into a lightweight security/trusted-html module, updated safeHtml to import from that path, and kept the public security exports unchanged through re-exports. No UI changes were involved.

Copilot

Pull request overview

Adds a first-class “trusted fragment” mechanism so safeHtml can compose already-sanitized/escaped HTML without rendering it as text, while keeping default escaping for normal interpolations.

Changes:

Introduces branded SanitizedHtml plus a TrustedHtml marker and trusted() helper for explicit opt-in composition.
Updates sanitizeHtml() and safeHtml to produce/consume branded sanitized output and splice trusted(...) content verbatim.
Adds targeted tests and updates guides to document the new composition pattern.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/security.test.ts	Adds a unit test for `trusted(sanitizeHtml(...))` stringification.
tests/component.test.ts	Adds coverage for `safeHtml` escaping and trusted fragment composition (including nested composition).
src/security/trusted-html.ts	New brands + `trusted()` marker, plus internal detection/unwrap helpers.
src/security/sanitize.ts	Makes `sanitizeHtml()` return `SanitizedHtml` and re-exports trusted helpers/types.
src/security/index.ts	Re-exports `trusted` and branded types from the security entrypoint.
src/full.ts	Re-exports `trusted` and branded types from the full/CDN bundle entrypoint.
src/component/html.ts	Updates `safeHtml` to return `SanitizedHtml` and splice trusted markers without escaping.
docs/guide/security.md	Documents trusted fragment composition with `trusted(sanitizeHtml(...))` inside `safeHtml`.
docs/guide/components.md	Updates component guide example to show `safeHtml` + `trusted(sanitizeHtml(...))` composition.

src/component/html.ts

src/security/sanitize.ts

JosunLP · 2026-03-13T22:20:48Z

@copilot apply changes based on the comments in this thread

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot · 2026-03-13T22:23:56Z

@copilot apply changes based on the comments in this thread

Addressed in 5b4ebef. safeHtml now uses toSanitizedHtml() for the branded return value, and sanitize.ts no longer re-exports the internal trusted-fragment helpers. No UI changes were involved.

Copilot

Pull request overview

Adds a trusted-fragment composition path so safeHtml can embed already-sanitized (or otherwise safe) HTML fragments without re-escaping, while keeping default escaping behavior for all other interpolations.

Changes:

Introduces branded SanitizedHtml and marker TrustedHtml, plus trusted() for verbatim reuse in safeHtml.
Updates sanitizeHtml() and safeHtml() to return SanitizedHtml, and updates safeHtml() to splice trusted(...) values without escaping.
Adds targeted tests and updates docs to describe the new composition pattern.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/security.test.ts	Adds coverage for `trusted(sanitizeHtml(...))` basic behavior.
tests/component.test.ts	Adds `safeHtml` escaping + trusted fragment composition tests.
src/security/trusted-html.ts	Defines `SanitizedHtml` / `TrustedHtml` and `trusted()` + internal helpers.
src/security/sanitize.ts	Makes `sanitizeHtml()` return `SanitizedHtml`; re-exports trusted/types.
src/security/index.ts	Re-exports `trusted`, `SanitizedHtml`, `TrustedHtml`, and `SanitizeOptions` from the security entrypoint.
src/full.ts	Re-exports `trusted` and the new branded types from the full bundle entrypoint.
src/component/html.ts	Updates `safeHtml` to return `SanitizedHtml` and splice trusted markers without escaping.
docs/guide/security.md	Documents trusted fragment composition with `trusted(sanitizeHtml(...))`.
docs/guide/components.md	Updates component guide example to show composing trusted fragments inside `safeHtml`.

src/security/trusted-html.ts

JosunLP · 2026-03-13T22:38:54Z

@copilot apply changes based on the comments in this thread

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot · 2026-03-13T22:42:10Z

@copilot apply changes based on the comments in this thread

Addressed in fb89b00. SanitizedHtml now uses a type-only brand symbol, toSanitizedHtml() is marked internal, and the brand docs now distinguish sanitized markup from safeHtml’s escaped-template output. No UI changes were involved.

Copilot

Pull request overview

Adds a typed, explicit “trusted sanitized fragment” mechanism so safeHtml can compose already-sanitized markup without rendering it as escaped text, while keeping default escaping for normal interpolations.

Changes:

Introduces branded SanitizedHtml plus a TrustedHtml marker via trusted() and internal unwrap helpers.
Updates sanitizeHtml() and safeHtml() to return SanitizedHtml, and teaches safeHtml to splice trusted(...) values verbatim.
Adds targeted tests and updates docs/examples to describe the new composition pattern and exports.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/security.test.ts	Adds coverage for `trusted(sanitizeHtml(...))` stringification.
tests/component.test.ts	Adds `safeHtml` escaping + trusted-fragment composition tests (including nesting).
src/security/trusted-html.ts	New branded types and trusted-marker implementation (`trusted`, `isTrustedHtml`, unwrap).
src/security/sanitize.ts	Changes `sanitizeHtml()` to return `SanitizedHtml`; re-exports `trusted` and types.
src/security/index.ts	Updates public security entrypoint exports to include `trusted` and branded types.
src/full.ts	Re-exports `trusted` and branded types from the full bundle entrypoint.
src/component/html.ts	Updates `safeHtml` to return `SanitizedHtml` and splice `TrustedHtml` without escaping.
docs/guide/security.md	Documents trusted fragment composition pattern for `safeHtml`.
docs/guide/components.md	Updates component guide example to demonstrate `trusted(sanitizeHtml(...))` composition.

* Add `bool()` support for boolean attributes in component templates (#55) Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Jonas Pfalzgraf <info@josunlp.de> * Add typed state generics to component definitions (#56) Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Jonas Pfalzgraf <info@josunlp.de> * Pass attribute change metadata to component `updated()` hooks (#58) Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Jonas Pfalzgraf <info@josunlp.de> * Add per-component sanitizer overrides for component render output (#57) * Initial plan * feat: add per-component sanitizer options Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: clarify component sanitizer baseline Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: warn about sensitive component sanitizer opts Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * test: cover sanitizer allowTags overrides Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * perf: precompute component sanitizer allowlists Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Signed-off-by: Jonas Pfalzgraf <info@josunlp.de> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> Co-authored-by: Jonas Pfalzgraf <info@josunlp.de> * Pass previous props into component `beforeUpdate` (#59) * Initial plan * Add previous props to beforeUpdate hook Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * Refine beforeUpdate old props implementation Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * Fix beforeUpdate typing regressions Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Signed-off-by: Jonas Pfalzgraf <info@josunlp.de> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> Co-authored-by: Jonas Pfalzgraf <info@josunlp.de> * Add explicit signal subscriptions to `component()` renders (#60) * Initial plan * feat: add component signal subscriptions Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * chore: document signal subscription tracking Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix: address signal integration review feedback Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix: tighten component signal typing Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix: resolve eslint failure in component signal test Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix: handle reconnect lifecycle and signal effect errors Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix: preserve reconnect signal wiring after hook errors Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix: skip beforeUpdate for signal rerenders Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Signed-off-by: Jonas Pfalzgraf <info@josunlp.de> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> Co-authored-by: Jonas Pfalzgraf <info@josunlp.de> * Add trusted sanitized fragments for `safeHtml` composition (#61) * Initial plan * feat: add trusted safeHtml fragment support Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * chore: finalize trusted safeHtml support Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: address trusted safeHtml review feedback Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: fix second trusted safeHtml review follow-up Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * refactor: split trusted html helpers from sanitizer Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * refactor: tighten trusted html branding Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: tighten trusted html internals Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Signed-off-by: Jonas Pfalzgraf <info@josunlp.de> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> Co-authored-by: Jonas Pfalzgraf <info@josunlp.de> * Reuse component shadow-root style nodes across re-renders (#62) * Initial plan * fix: reuse component style element on rerender Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * chore: finalize component style reuse fix Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * test: tighten style reuse regression assertions Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * Add `@bquery/bquery/storybook` template helpers for Storybook stories (#63) * Initial plan * feat: add storybook template helper Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: clarify storybook when fallback behavior Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix: keep storybook helpers out of full bundle Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix: sanitize storybook helper output Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * test: tighten storybook helper security coverage Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * feat: enhance storyHtml with improved boolean attribute handling and sanitization tests * fix: update storyHtml example to reflect correct boolean attribute output * fix: defensive tag delimiter and parser comments per code review Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * chore: release version 1.6.0 - Update CHANGELOG.md for version 1.6.0 release notes including added features, changes, fixes, and security improvements. - Enhance README.md to document new boolean attribute helpers and Storybook integration. - Update bun.lock to reflect dependency upgrades for Storybook and happy-dom. - Modify definition.md to include new Storybook helpers and component state management features. - Revise components.md to demonstrate new boolean attribute handling and typed state in components. - Update getting-started.md with Storybook authoring examples and improved module descriptions. - Enhance security.md to clarify sanitization practices and introduce trusted fragment handling. - Revise index.md to highlight new Storybook helpers in the feature list. - Update llms.txt to reflect the new version 1.6.0. - Bump version in package.json to 1.6.0 and update devDependencies for Storybook. * Address review feedback for test setup, test type coverage, and component state keys (#65) * Initial plan * Address review feedback for test typing and setup Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * Finalize review feedback fixes Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * Export component state key type Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * Default component state key generic Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * Tighten component/state update semantics and Storybook attribute sanitization (#66) * Initial plan * fix review follow-up for state updates and storybook sanitization Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix storybook attribute value scanning Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * fix storybook interpolation boundary parsing Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs align storybook attribute scan jsdoc Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Signed-off-by: Jonas Pfalzgraf <info@josunlp.de> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Initial plan * feat: add trusted safeHtml fragment support Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * chore: finalize trusted safeHtml support Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: address trusted safeHtml review feedback Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: fix second trusted safeHtml review follow-up Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * refactor: split trusted html helpers from sanitizer Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * refactor: tighten trusted html branding Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> * docs: tighten trusted html internals Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> --------- Signed-off-by: Jonas Pfalzgraf <info@josunlp.de> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com> Co-authored-by: Jonas Pfalzgraf <info@josunlp.de>

Initial plan

3c88806

Copilot AI assigned Copilot and JosunLP Mar 13, 2026

Copilot started work on behalf of JosunLP March 13, 2026 11:23 View session

Copilot AI and others added 2 commits March 13, 2026 11:29

feat: add trusted safeHtml fragment support

0e050e2

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

chore: finalize trusted safeHtml support

fb4d8c4

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] [FR-7] Add trusted marker for safeHtml interpolation~~ Add trusted sanitized fragments for safeHtml composition Mar 13, 2026

Copilot AI requested a review from JosunLP March 13, 2026 11:34

Copilot finished work on behalf of JosunLP March 13, 2026 11:34

JosunLP marked this pull request as ready for review March 13, 2026 11:37

Copilot AI review requested due to automatic review settings March 13, 2026 11:37

github-actions bot added component Changes to the component module security Changes to the security module docs Changes to the documentation tests Chenges to the tests labels Mar 13, 2026

Copilot started reviewing on behalf of JosunLP March 13, 2026 11:37 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

docs/guide/security.md Outdated Show resolved Hide resolved

src/security/sanitize.ts Outdated Show resolved Hide resolved

docs/guide/components.md Outdated Show resolved Hide resolved

src/security/sanitize.ts Outdated Show resolved Hide resolved

Merge branch 'development' into copilot/add-trusted-marker-to-safehtml

a9897a4

Signed-off-by: Jonas Pfalzgraf <info@josunlp.de>

Copilot started work on behalf of JosunLP March 13, 2026 21:40 View session

docs: address trusted safeHtml review feedback

a235d1f

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot finished work on behalf of JosunLP March 13, 2026 21:46

JosunLP requested a review from Copilot March 13, 2026 21:50

Copilot started reviewing on behalf of JosunLP March 13, 2026 21:50 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

docs/guide/security.md Outdated Show resolved Hide resolved

src/component/html.ts Show resolved Hide resolved

Copilot started work on behalf of JosunLP March 13, 2026 21:59 View session

docs: fix second trusted safeHtml review follow-up

b699a34

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot started reviewing on behalf of JosunLP March 13, 2026 22:03 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

src/component/html.ts Outdated Show resolved Hide resolved

Copilot started work on behalf of JosunLP March 13, 2026 22:07 View session

refactor: split trusted html helpers from sanitizer

3fcb0fc

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot finished work on behalf of JosunLP March 13, 2026 22:12

JosunLP requested a review from Copilot March 13, 2026 22:14

Copilot started reviewing on behalf of JosunLP March 13, 2026 22:15 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

src/component/html.ts Outdated Show resolved Hide resolved

src/security/sanitize.ts Outdated Show resolved Hide resolved

Copilot started work on behalf of JosunLP March 13, 2026 22:20 View session

refactor: tighten trusted html branding

5b4ebef

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot finished work on behalf of JosunLP March 13, 2026 22:24

JosunLP requested a review from Copilot March 13, 2026 22:26

Copilot started reviewing on behalf of JosunLP March 13, 2026 22:27 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

src/security/trusted-html.ts Show resolved Hide resolved

src/security/trusted-html.ts Outdated Show resolved Hide resolved

src/security/trusted-html.ts Outdated Show resolved Hide resolved

Copilot started work on behalf of JosunLP March 13, 2026 22:39 View session

docs: tighten trusted html internals

fb89b00

Co-authored-by: JosunLP <20913954+JosunLP@users.noreply.github.com>

Copilot finished work on behalf of JosunLP March 13, 2026 22:42

JosunLP requested a review from Copilot March 13, 2026 22:46

Copilot started reviewing on behalf of JosunLP March 13, 2026 22:47 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

JosunLP merged commit 8a1bf43 into development Mar 13, 2026
14 checks passed

JosunLP deleted the copilot/add-trusted-marker-to-safehtml branch March 13, 2026 22:50

Uh oh!

Conversation

Copilot AI commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JosunLP commented Mar 13, 2026

Uh oh!

Copilot AI commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

JosunLP commented Mar 13, 2026

Uh oh!

Copilot AI commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

JosunLP commented Mar 13, 2026

Uh oh!

Copilot AI commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

JosunLP commented Mar 13, 2026

Uh oh!

Copilot AI commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JosunLP commented Mar 13, 2026

Uh oh!

Copilot AI commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 13, 2026 •

edited

Loading