Skip to content

HtmlEditor: pass the initial value to Quill without the live DOM and harden the SSR sanitizer - #36256

Open
pharret31 wants to merge 1 commit into
DevExpress:26_1from
pharret31:5523-htmleditor-sanitizehtml-allows-javascript-and-iframe-srcdoc-26-1
Open

pharret31 wants to merge 1 commit into
DevExpress:26_1from
pharret31:5523-htmleditor-sanitizehtml-allows-javascript-and-iframe-srcdoc-26-1

Conversation

@pharret31

@pharret31 pharret31 commented Nov 11, 2026 •

Copy link
Copy Markdown
Contributor

Cherry-pick of #36251

@pharret31 pharret31 self-assigned this Nov 11, 2026
@pharret31
pharret31 requested a review from a team as a code owner November 11, 2026 13:11
@pharret31 pharret31 changed the title HtmlEditor: sanitize meta, base, srcdoc and script URLs in the value HtmlEditor: pass the initial value to Quill without the live DOM and harden the SSR sanitizer Nov 12, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant