Greasy Fork

fix: harden HTML sanitization, CommonMark fence/code-span scanning, and observer-driven re-rendering

• Block tags that can hijack or impersonate the page (iframe, base, meta, form, style, link, object, embed, script, video, audio); check attributes individually so event handlers, srcdoc, and URL schemes (including character-reference and tab/newline smuggling) are caught without false positives on harmless attribute values
• Sanitize markdown-generated links and images (javascript:/data: payloads are dropped instead of emitted verbatim); markdown links never passed through the html() policy
• Scope blocked-tag pairing to a single parse and match case-insensitively so one message's escaped tags cannot leak into another
• Configure a private marked instance so the page-global marked is untouched
• Rewrite fence/code-span scanning to mirror CommonMark (matching-char fences closed by runs of at least the opening length, equal-length inline code spans), keeping blank-line collapse correct after mismatched fences and preserving span content instead of mangling it
• Observe characterData mutations (React updates text nodes via nodeValue) and filter mutations to user-message groups, new groups, and theme changes so AI-streaming churn never triggers a full-page scan
• Re-render messages from stored raw markdown when the page theme changes so md-code-block dark/light variants stay correct
• Dedupe the window/document capture listeners so an edit click restores once instead of twice
• Add tests for all of the above; bump to v1.0.7 and sync READMEs

fix: chat-style line breaks, compact block spacing, and correct setext/footnote/br handling on marked 18

chore: note webhook sync in script comment

chore: switch to master branch and bump to v1.0.5

OpenUserJS's GitHub webhook only accepts pushes to refs/heads/master, so the default branch is renamed from main to master and all raw URLs are updated accordingly.