From 02cebc06ce40506b3b27ceabd734691a92f8dd26 Mon Sep 17 00:00:00 2001 From: weichen Date: Sun, 4 Oct 2026 18:25:01 +0000 Subject: [PATCH] Keep empty HTML clears out of the sink ratchet Why: Preview setup clears a node with innerHTML = '' before appending sanitized children, and the ratchet treated that space as a write. Evidence: npx vitest run test/html-sinks.test.ts. Non-empty assignments still match. Impact: The preview path can keep clearing nodes. Writing HTML strings in components still fails the test. Refs: docs/records/2026-10-04-sillytavern-review.md --- test/html-sinks.test.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/html-sinks.test.ts b/test/html-sinks.test.ts index b34e1b5..7a487d1 100644 --- a/test/html-sinks.test.ts +++ b/test/html-sinks.test.ts @@ -22,7 +22,8 @@ describe('html sinks', () => { const text = readFileSync(file, 'utf8') const rel = relative(SRC, file) if (text.includes('dangerouslySetInnerHTML')) hits.push(`${rel}: dangerouslySetInnerHTML`) - if (/innerHTML\s*=\s*(?!['"]['"])/.test(text)) hits.push(`${rel}: innerHTML`) + // 空白放进前瞻里，避免 \s* 回退到空格前面、把 innerHTML = '' 误判成写入。 + if (/innerHTML\s*=(?!\s*['"]['"])/.test(text)) hits.push(`${rel}: innerHTML`) } expect(hits).toEqual([]) })