{"version":"2.1.234","anchor":"artifact-script-check-no-longer-fooled-by-escaped-tag-tricks","canonical_anchor":"artifact-script-check-no-longer-fooled-by-escaped-tag-tricks","heading":"Artifact script check no longer fooled by escaped-tag tricks","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/artifact-script-check-no-longer-fooled-by-escaped-tag-tricks","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Artifact script check no longer fooled by escaped-tag tricks\n\nArtifact scripts can no longer sneak past the approval check using escaped markup tricks.\n\n**What**\n\nThe embedded artifact skill's check for which scripts are approved was tightened so markup that a browser tokenizer reads one way and the checker read another can no longer slip through.\n\n**Details**\n\n- Whitespace trimming now uses exactly the HTML ASCII whitespace set instead of JavaScript's `trim`, so characters the tokenizer treats as text are no longer trimmed away.\n- A new open-tag walker tracks quoted attribute values, so a `>` inside a quoted value no longer ends the tag early.\n- A comment opener combined with a script opener inside script data is now refused outright rather than modelled.\n- The approved hash for the decisions block changed to match, and comments mark the parallel implementation these must stay in sync with.\n\n**Evidence**\n\n`script-not-blessed`\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}