# custom-pages

HTML and CSS sanitization for MNW Custom Pages: creator-authored page content
turned into something safe to render.

Creators write raw HTML and CSS for their profile and project pages. Nothing
they write is trusted, and nothing sanitized here is stored. Sanitization is
render-time, over the raw input, on every render. The database holds what the
creator typed; this crate is the boundary between that and a rendered page.

It lives outside the MNW server for one reason: a fuzz target that has to build
the whole server is a fuzz target nobody runs. The crate imports nothing from
MNW. A caller supplies a `UrlPolicy` and an owner scope, and gets back sanitized
output plus every reference that was stripped.

## What it promises

**No execution.** Nothing that survives either path can run: no `<script>`, no
event-handler attribute, no `javascript:`, no `expression()`, no `@import`.

**A closed system.** No URL survives that resolves off-platform. Every
reference (an HTML attribute, a `srcset` candidate, a CSS `url()`) must resolve
to a host the policy names. References are stripped, never rewritten, so a creator's
own URLs are left as they wrote them.

**A scoped canvas.** Every CSS rule that survives is confined to
`.user-canvas#uc-{owner}`. A stylesheet cannot reach platform chrome, and it
cannot hide a non-removable system slot.

Both of the first two, plus scoping, are asserted by `oracle`, which is a
public module rather than a fuzzing-only one: `tests/regressions.rs` runs it on
stable and the soak tier's target runs it on nightly, so neither side can drift
into checking less than the other.

## Corpora

`fuzz/seeds/{html,css}/` is human intent: the shapes worth reaching first.
`fuzz/regressions/` is inputs that once found a bug; anything landing there is a
permanent test by virtue of the directory. Both replay on every `cargo test`.

## The lightningcss pin

`lightningcss` is pinned exactly, not floated. It is a pre-1.0 alpha whose
`CssRule` enum is matched exhaustively here on purpose: a new at-rule must be a
compile error and then a deliberate allow-or-block decision, never a silent
pass-through.

The committed lockfile also pins `parcel_selectors` to 0.28.2. lightningcss
accepts `^0.28`, but 0.28.3 moved to a `cssparser` major that lightningcss
itself does not use, so a fresh resolve puts two incompatible `cssparser`
versions in one graph and lightningcss stops compiling. Keep the pin.