Fix: re-scrub meta content rewrites and noscript re-renders#180
Merged
Conversation
Closes the two coverage gaps left open by #176's scrub-don't-detach refactor: - `meta-injection-strip` — an in-place `content=` rewrite on a meta we already blanked sat visible until the next route change. Added `content` to `OBSERVED_ATTRIBUTES` and `observeAttributes: true` on both watchers so the rewrite reaches `scrubMeta`. - `noscript-strip` — children rendered INTO a kept `<noscript>` weren't recognized because `stripNoscript` only walked downward. Replaced the self-only branch with a `closest(\"noscript\")` ancestor-or-self check so additions under a kept noscript re-trigger blanking of the wrapper. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #177.
Summary
Closes the two coverage gaps left open by #176's scrub-don't-detach refactor.
meta-injection-strip— after Fix: scrub instead of detach for framework-rendered DOM #176, the meta stays attached. If a framework or page script later overwritescontent=on a meta we already blanked, the new payload was visible until the next route change. Added"content"toOBSERVED_ATTRIBUTESinsubtree-watcher.tsandobserveAttributes: trueon both watchers so the rewrite delivers the meta back intoscrubMeta.noscript-strip—stripNoscriptonly walked downward, so when children were rendered INTO a kept<noscript>the new fallback wasn't recognized. Replaced the self-only branch with aclosest("noscript")ancestor-or-self check; an addition under a kept noscript re-blanks the wrapper.Each is a low-likelihood path in practice (frameworks rarely re-render noscript children, and content-attribute rewrites are usually paired with full route swaps), but both are real and pre-#176 they were masked by the detach.
Coverage notes
contentmutation also reachesselector-token-index(the otherobserveAttributes: truesubscriber).collectTokensis a no-op for token-less mutations, so impact is bounded to a complex-selector scan against the meta element.closest("noscript")on the added subtree subsumes the prior self-only branch — semantics are unchanged for additions that are themselves a<noscript>.Out of scope
html-comment-stripbroad-sweep restoration with framework-marker allowlist.INJECTION_PATTERNSaudit on attribute-targeted rules.Test plan
bun run testinextension/: 1383 / 1383 passing across 77 suites (3 new — 1 noscript, 2 meta).bun run checkclean.🤖 Generated with Claude Code