René's URL Explorer Experiment

Title: Release 1.15.1 — security & correctness patch by JosunLP · Pull Request #202 · bQuery/bQuery · GitHub

Open Graph Title: Release 1.15.1 — security & correctness patch by JosunLP · Pull Request #202 · bQuery/bQuery

X Title: Release 1.15.1 — security & correctness patch by JosunLP · Pull Request #202 · bQuery/bQuery

Description: Release 1.15.1 — Security & correctness patch Promotes dev to main for the 1.15.1 patch release. This closes the findings of a full-codebase security & correctness audit (issues #162–#181). No breaking changes. No module status transitions. Every 1.15.0 and earlier API continues to work unchanged — upgrading is a drop-in. Security fixes Area Fix Issue security mXSS-detection fallback in sanitizeHtml now HTML-escapes its text result (reachable through every HTML sink) #162 ssr bq-text on raw-text elements (textarea/title) escaped in the pure renderer (stored XSS) #163 view/ssr bq-bind guards on*/URL/srcset/srcdoc values via a shared bind-guard #164 view with-scoped evaluator shadows dangerous globals — closes constructor.constructor(…)() RCE #168 ssr DOM-backed evaluator routed through the CSP-safe parser (removes new Function()) #167 server session + CSRF cookies default to Secure #169 security Trusted Types wired into HTML sinks (new trustedHtmlForSink()) #171 ssr bq-style declarations validated (CSS injection) #176 security expanded DOM-clobbering denylist + duplicate-id stripping #179 i18n own-property checks for placeholder/key resolution #174 store deepClone guards __proto__ #175 server file-route loaders default to the action middleware chain (authz) #181 Correctness fixes Area Fix Issue store $subscribe snapshots subscribers (no skip on unsubscribe-during-notify) #165 reactive self-triggering effects bounded instead of overflowing the stack #166 view/compiler bail on unterminated string / invalid numeric literals #170 reactive overlapping useFetch/useAsyncData abort the superseded request #172 reactive/concurrency disposal paths for deferred() / persistedSignal() (+ effectScope(detached)) #173 ssr titleTemplate inserts the title literally (no $& mangling) #177 core debounce({leading,trailing}) no longer double-invokes a single call #178 view bq-on invokes handlers via evaluation, not a paren heuristic #180 Additive APIs (backwards-compatible) trustedHtmlForSink() — @bquery/bquery/security (also on /full) effectScope(detached?) — @bquery/bquery/reactive deferred() handle now exposes dispose() Migration notes Two behavioural defaults tightened, both with explicit opt-outs: Server session/CSRF cookies now set Secure → pass cookie: { secure: false } for local HTTP dev. File-route JSON loaders now inherit middlewares → pass dataMiddlewares: [] to keep them unauthenticated. Release chores package.json: 1.15.0 → 1.15.1 CHANGELOG.md: new [1.15.1] section (Security + Fixed) and TOC entry Docs: new release-notes/1.15.1 page, nav + index entries, trustedHtmlForSink() documented in the Security guide Validation bun test: 3043 pass / 0 fail tsc --noEmit (src + tests): clean bun run build: succeeds check:stability, check:doc-exports (security 11/11), check:full-bundle: pass 🤖 Generated with Claude Code Summary by CodeRabbit Security Hardened HTML/SSR rendering and bq-bind/bq-html/bq-text handling against XSS, dangerous URL protocols, DOM clobbering, and prototype-chain attacks. Added/strengthened Trusted Types protections and SSR CSP-safe evaluation behavior. Updated secure-by-default cookie settings (session + CSRF) and improved authorization middleware inheritance for generated JSON loader routes. Bug Fixes Fixed store subscriber notification stability, bounded reactive cyclic re-runs, deferred cleanup/disposal behavior, and overlapping useFetch aborting. Corrected debounce leading+trailing behavior and various SSR/template and i18n edge cases. New Features Added trustedHtmlForSink helper for Trusted Types HTML sink assignments. Added effectScope(detached) with manual stopping and enhanced deferred() to support explicit disposal.

Open Graph Description: Release 1.15.1 — Security & correctness patch Promotes dev to main for the 1.15.1 patch release. This closes the findings of a full-codebase security & correctness audit (issues #162–#181)....

X Description: Release 1.15.1 — Security & correctness patch Promotes dev to main for the 1.15.1 patch release. This closes the findings of a full-codebase security & correctness audit (issues #16...

Opengraph URL: https://github.com/bQuery/bQuery/pull/202

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width