HTML sanitizing and a refusal message ship in the artifact editing skill, whose registration check is false.
What
Because a save now republishes whole-page HTML that other viewers will run, the artifact editing skill sanitizes it first and refuses saves it cannot publish cleanly, with the message "Couldn't save. Part of this content can't be published." Part of the same skill, whose registration check is false in this build.
Details
- A tag denylist covers SCRIPT, IFRAME, FORM, INPUT, TEMPLATE, FOREIGNOBJECT, MATH, PORTAL and more.
- Stripped attributes include every
on*handler,srcdoc,autofocus,name, and the top-layer setpopover,popovertarget,interestfor,commandfor,command. - URL attributes are scheme-checked, with per-entry checks inside
srcsetandping;data:URIs are allowed only for images; style attributes are rejected if they containurl(,expression(or a backslash. - Comments that could terminate the document early or that read as the runtime marker are removed.
- The save must also survive the browser's own re-parse unchanged: outside the article it must match the served shell node for node, or the save is refused.
Evidence
Couldn\u2019t save. Part of this content can\u2019t be published.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.