Security
Two bypasses reported against 1.0.15, both closed here.
Dangerous URL schemes survived in every URL attribute except href. isDangerousUrl() gated on ['href', 'xlink:href'], but the allow-list admits many more URL-valued attributes — action, cite, poster, src, srcset, background — and none of them were scheme-validated. Because form, button/input and type are all allowed by default, a complete submittable form whose action was a javascript: URI round-tripped intact and executed on submit (ref GHSA-mrpv-6x26-mf6c, reported by @0xMoError-22). The scheme check now applies to every URL-bearing attribute, srcset is judged per comma-separated candidate so a scheme cannot hide in a later one, and the post-serialization regex pass covers the same set as a second net.
CSS comments and escapes defeated the url() check in SVG presentation attributes. isExternalUrl() matched the raw attribute value, so fill="url(\2f\2f evil.example/x)" or fill="url(/**/ //evil.example/x)" passed while the browser's CSS tokenizer decoded the escape or dropped the comment and fetched the external resource — the same parser-differential as GHSA-ww22-4mqv-x5w3, on the attributes that fix never covered (ref GHSA-cjfg-j8jp-5xvc, reported by @0xMoError-22). The value is now run through the same CSS normalizer the <style> and style paths use before matching.
On severity: the form-action vector is directly executable stored XSS (CWE-79) and the presentation-attribute vector is an external resource load (CWE-184); both require the consumer to render sanitized output, and the form vector requires a victim submission. Benign values — relative actions, url(#fragment) references, inert data:image/* URLs, multi-candidate srcset — are unaffected, and the suite now carries regression tests for every payload and every preserved case. Suite is green at 129 tests / 247 assertions.
Anyone embedding untrusted SVG or HTML should update. Grav users should take the next Grav release, which bundles this version.
