Add escape-html function that escapes HTML special characters and apply
it in the comment editor at four dom/set-html! call sites where
user-provided text is inserted as innerHTML, preventing stored XSS.
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
The ::mf/props and ::mf/wrap-props metadata keys are no-ops on modern
components (those defined with mf/defc and the * suffix) since the *
suffix already triggers the props behavior these keys attempt to
configure. This cleanup removes the redundant metadata from modern
components across all UI directories.
Changes:
- comments/: comments
- dashboard/: comments, deleted, files, fonts, grid, import, libraries,
pin_button, projects, search, sidebar, subscription, team, templates
- exports/: files
- modal/: modal
- settings/: subscription
- static/: static
- viewer/: comments, interactions, viewer
- workspace/: context_menu, libraries, sidebar/assets,
viewport/gradients, tokens/settings/menu
* ✨ Make links in comments clickable
Detect URLs in comment text and render them as clickable links that
open in a new tab. Extends the existing mention parsing to also split
text elements by URL patterns, handling trailing punctuation and
mixed mention+URL content.
Closes#1602
* 📚 Add changelog entry for clickable links in comments
* 🐛 Fix URL elements dropped in comment input initialization
* 🐛 Keep empty text elements in parse-urls to preserve cursor anchors
The remove filter in parse-urls was stripping empty text elements
produced by str/split at URL boundaries. These elements are needed
as cursor anchor spans in the contenteditable input, without them
ESC keydown and visual layout broke.
Signed-off-by: eureka928 <meobius123@gmail.com>
* ♻️ Rename old icons as deprecated
* ♻️ Take icons from the namespace for the icon component
* ♻️ Take icons from the namespace for the icon-button component
* ♻️ Remove obsolete CSS code
* 🐛 Fix post a comment with keyboard
* 🐛 Fix show comments cursor on view mode
* 🐛 Fix avoid comment bubbles to appear on top of sidebars
* 🐛 Fix cancel native browser zoom when comment threads are visible
It includes:
- a revert for recursive transformations for :> handler
- a revert for use-state stable reference handling
- a partial support for malli decoding on props validation
