What
The embedded artifact skill's check for which scripts are approved was tightened so markup that a browser tokenizer reads one way and the checker read another can no longer slip through.
Details
- Whitespace trimming now uses exactly the HTML ASCII whitespace set instead of JavaScript's
trim, so characters the tokenizer treats as text are no longer trimmed away. - A new open-tag walker tracks quoted attribute values, so a
>inside a quoted value no longer ends the tag early. - A comment opener combined with a script opener inside script data is now refused outright rather than modelled.
- The approved hash for the decisions block changed to match, and comments mark the parallel implementation these must stay in sync with.
Evidence
script-not-blessed
Strings lifted out of the shipped bundle, so the claim above can be checked against them.