You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
bug(core): push() skips sanitizeText when text is undefined #248
In ctx.push(), sanitizeText is only called when text is truthy. When text is undefined (or an empty string), the sanitizer is bypassed and the fallback '' is stored directly. This is inconsistent with DOM-based focus paths where the sanitizer always runs on the extracted text.
Low in most cases (empty string is safe), but it creates an inconsistent contract for users who configure sanitizeText expecting it to intercept every stored text value, including empty/undefined ones.
Activity
fix: audit fixes for sanitizer leaks, context cleanup, and listener t…