{"version":"2.1.234","anchor":"saved-artifact-html-is-sanitized-and-refused-if-it-will-not-","canonical_anchor":"saved-artifact-html-is-sanitized-and-refused-if-it-will-not-","heading":"Saved artifact HTML is sanitized and refused if it will not round-trip","tier":"soon","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/saved-artifact-html-is-sanitized-and-refused-if-it-will-not-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Saved artifact HTML is sanitized and refused if it will not round-trip\n\nArtifact saves get sanitized and refused if the content cannot be published cleanly, in a disabled skill.\n\n**What**\n\nBecause a save now republishes whole-page HTML that other viewers will run, the artifact editing skill sanitizes it first and refuses saves it cannot publish cleanly, with the message \"Couldn't save. Part of this content can't be published.\" Part of the same skill, whose registration check is false in this build.\n\n**Details**\n\n- A tag denylist covers SCRIPT, IFRAME, FORM, INPUT, TEMPLATE, FOREIGNOBJECT, MATH, PORTAL and more.\n- Stripped attributes include every `on*` handler, `srcdoc`, `autofocus`, `name`, and the top-layer set `popover`, `popovertarget`, `interestfor`, `commandfor`, `command`.\n- URL attributes are scheme-checked, with per-entry checks inside `srcset` and `ping`; `data:` URIs are allowed only for images; style attributes are rejected if they contain `url(`, `expression(` or a backslash.\n- Comments that could terminate the document early or that read as the runtime marker are removed.\n- The save must also survive the browser's own re-parse unchanged: outside the article it must match the served shell node for node, or the save is refused.\n\n**Evidence**\n\n`Couldn\\u2019t save. Part of this content can\\u2019t be published.`\n\n- Area: Artifacts\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 3\/5\n- Present in the build but not switched on"}