Security & compliance

Regulated security profile

Set regulated: true or security.profile: "regulated" to lock sanitization, paste filtering, Trusted Types, same-origin runtime loading, SHA-256 runtime integrity, safe URL handling, and community-plugin restrictions. Unsafe override attempts are ignored and reported through onSecurityViolation.

const { integrity } = await fetch(
  "/vendor/editra/plugins/runtime-integrity.json"
).then(response => response.json());

const editor = await Editra.init({
  selector: "#editor",
  regulated: true,
  security: { profile: "regulated", pluginIntegrity: integrity },
  onSecurityViolation(event) { sendRedactedSecurityEvent(event); }
});

mXSS, CSP, and runtime integrity

Editra stabilizes sanitized markup across browser parsing cycles, separates trusted content from fixed UI templates, and tests generated and fixed mutation-XSS cases. Its regulated policy is designed to operate without unsafe-inline or unsafe-eval. The initial entry and integrity manifest remain deployment trust anchors.

Structured JSON document model

getJSON(), validateJSON(), and setJSON() use a versioned schema with strict node, attribute, depth, count, and text limits. JSON imports construct DOM nodes through browser APIs and still pass through the stable HTML sanitizer.

const documentModel = editor.getJSON();
const result = editor.validateJSON(documentModel);
if (result.valid) editor.setJSON(documentModel);

Separate-origin iframe isolation

Set isolation: "iframe" with an approved isolationUrl. Regulated use requires the frame on a separate origin so the parent cannot read its DOM. The asynchronous proxy authenticates messages by window, exact origin, random channel, known operation, request ID, and payload limits.

Compliance and assurance boundary

Editra provides technical evidence useful for PCI DSS, SOC 2, and regional financial-sector assessments, including a CycloneDX SBOM, dependency audit, integrity verification, cross-browser tests, and vulnerability disclosure policy. It is not independently certified and does not have a SOC 2 Type II, ISO 27001, PCI attestation, penetration-test report, or central-bank approval. Compliance applies to the complete deployed system and must be assessed by the adopter.

Open regulated-profile example → · Open structured JSON example →