Sanitizer: validate srcset URLs and fail closed without DOMParser - #42840

Open

aljojoby9 wants to merge 6 commits into

aljojoby9:fix/sanitizer-srcset-and-fail-closed

Commits on Aug 13, 2026

Sanitizer: validate srcset URLs and fail closed without DOMParser
aljojoby9
committed
363e0fb
Fix lint and raise JS bundlewatch budgets
aljojoby9
committed
2d84758
Move no-script-url disables onto the fixture strings
aljojoby9
committed
91e279a
Parse data: srcset candidates without swallowing later URLs
aljojoby9
committed
718eba2
Give the JS budgets slack after the srcset parser grew
aljojoby9
committed
d9ed2af
Split data: srcset candidates even when the comma has no spaces
aljojoby9
committed
ca70428