feat(Style Editor): Implement Style Editor Sidenav Trigger in UVE

[rjvelazco]

Video

video.mov

This PR fixes: #33997

This PR fixes: #33997

[semgrep-code-dotcms-test]

Semgrep found 2 ssc-1401e86e-5347-4e09-9335-667e8dfa5deb findings:

• core-web/libs/portlets/edit-ema/portlet/src/lib/edit-ema-editor/edit-ema-editor.component.ts
  • L114-143 - Triage
• core-web/libs/portlets/edit-ema/portlet/src/lib/edit-ema-editor/components/dot-uve-palette/dot-uve-palette.component.spec.ts
  • L31-42 - Triage

Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the attributeName binding on SVG animation elements (<animate>, <set>, etc.) as requiring strict URL sanitization. An attacker who can supply untrusted input to template bindings like [attr.xlink:href] or <animate [attributeName]="'href'" [values]="maliciousURL"> can inject a javascript: URL payload. When the element is activated (e.g. clicked) or the animation runs, the malicious script executes in the application's origin, enabling session hijacking, data exfiltration, or unauthorized actions.

Manual Review Advice: A vulnerability from this advisory is reachable if you allow SVG/MathML attributes (e.g., xlink:href, href) or to the attributeName field of SVG animation tags (, , etc.) in HTML templates

Fix: Upgrade this library to at least version 20.3.15 at core/core-web/yarn.lock:557.

Reference(s): GHSA-v4hv-rgfq-gp49, CVE-2025-66412

If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.

[Copilot]

Pull request overview

This PR implements a Style Editor sidenav trigger in the Universal Visual Editor (UVE), introducing a new tab in the palette for styling contentlets. The implementation includes significant refactoring of the contentlet tools component and state management.

Key Changes:

• Added new Style Editor tab to the UVE palette with feature flag support
• Refactored contentlet controls from EmaContentletToolsComponent to DotUveContentletToolsComponent with improved architecture
• Introduced withPageContext feature to centralize common computed signals across the store
• Added support for registering and selecting contentlets to trigger style editing

Reviewed changes

Copilot reviewed 44 out of 45 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
core-web/libs/sdk/types/src/lib/editor/public.ts	Added REGISTER_STYLE_SCHEMAS action enum for style editor integration
core-web/libs/portlets/edit-ema/portlet/src/lib/store/features/withPageContext.ts	New feature consolidating shared computed signals like $isPageLocked, $canEditPage, $isStyleEditorEnabled
core-web/libs/portlets/edit-ema/portlet/src/lib/store/features/editor/models.ts	Added StyleSchema interface, UVE_PALETTE_TABS enum, and refactored palette state structure
core-web/libs/portlets/edit-ema/portlet/src/lib/store/features/editor/withEditor.ts	Major refactor: added $styleSchema, $showContentletControls, $allowContentDelete computeds; updated palette structure
core-web/libs/portlets/edit-ema/portlet/src/lib/store/features/load/withLoad.ts	Removed duplicate canEditPage and pageIsLocked computation (now in withPageContext)
core-web/libs/portlets/edit-ema/portlet/src/lib/store/dot-uve.store.ts	Integrated withPageContext feature and removed duplicate computed signals
core-web/libs/portlets/edit-ema/portlet/src/lib/edit-ema-editor/edit-ema-editor.component.ts	Added style editor triggers, contentlet selection, drag image handling, and iframe resize observer
core-web/libs/portlets/edit-ema/portlet/src/lib/edit-ema-editor/components/dot-uve-contentlet-tools/*	Complete rewrite of contentlet tools component with better signal-based architecture
core-web/libs/portlets/edit-ema/portlet/src/lib/edit-ema-editor/components/dot-uve-palette/*	Added Style Editor tab with feature flag, updated to use controlled activeTab input
core-web/libs/portlets/edit-ema/portlet/src/lib/utils/index.ts	Renamed computePageIsLocked to computeIsPageLocked for better naming consistency
Test files	Comprehensive test updates reflecting component and state management refactoring

Comments suppressed due to low confidence (1)

core-web/libs/portlets/edit-ema/portlet/src/lib/edit-ema-editor/components/dot-uve-contentlet-tools/dot-uve-contentlet-tools.component.scss:49

• The pointer-events: all property is duplicated on lines 46 and 48 for the same selectors. Remove one of the duplicate declarations.

Feedback addressed