Skip to content

Reject Tribute attachment to non-editable elements - #21

Open
pkaminski wants to merge 1 commit into
codex/security-dependencies-20261024from
codex/fix-tribute-editability
Open

pkaminski wants to merge 1 commit into
codex/security-dependencies-20261024from
codex/fix-tribute-editability

Conversation

@pkaminski

@pkaminski pkaminski commented Oct 26, 2026 •

Copy link
Copy Markdown
Member

Attaching Tribute to a plain div or to contenteditable="false" currently succeeds because contentEditable contains a truthy string. Check isContentEditable instead so the existing error guard uses effective editability, including inheritance. Inputs and textareas remain accepted.

Add six browser regression cases covering plain and explicitly disabled divs, explicit and inherited editability, inputs, and textareas. Update the README examples, rebuild all distributed bundles, and bump the publishable library from 5.1.3 to 5.1.4.

Validation: the two rejection tests failed against the original bundles while the other 36 passed. After the fix and Rollup rebuild, all 38 tests pass in headless Chrome. git diff --check passes.

Follow-up to the migration review. Stacked above security PR #18 and Yarn migration #19; merge from the bottom of the stack.

Linux CI also passes: immutable install, build, and all 38 browser tests. This PR is now part of native stack #20; Jacob (@earlAchromatic) is requested for review.


This change is Reviewable

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-27T00:45:09.857620Z 5bb91ac New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Devin Review

@pkaminski
pkaminski added this pull request to stack #20 October 26, 2026 21:01

@pkaminski pkaminski left a comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pkaminski reviewed 9 files and all commit messages.
Reviewable status: 0 of 9 files reviewed, all discussions resolved (waiting on earlAchromatic).

@pkaminski
pkaminski force-pushed the codex/fix-tribute-editability branch from bf6b17a to 5bb91ac Compare October 27, 2026 00:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant