Skip to content

v0.4.1 — security hardening

Choose a tag to compare

View all tags
@scttbnsn scttbnsn released this 30 Jun 22:25
v0.4.1
241949c

A security-hardening patch. These fixes were flagged by CodeQL and landed just after 0.4.0 went out; since they touch shipped src/ files, this release gets them to users.

Security fixes

  • Markdown-table escaping — the escapeCell helpers (interview packet, sourced-intake, sourced-delta) now escape backslashes before pipes, so a trailing \ can't escape the cell delimiter and break out of a table cell. (js/incomplete-sanitization)
  • HTML stripper — the liveness job-link checker's htmlToText now tolerates whitespace in </script > / </style > end-tags, closing a tag-filter bypass. (js/bad-tag-filter)
  • Library drawer — tag rendering clones DOM nodes instead of round-tripping innerHTML, removing an XSS-through-DOM path. (js/xss-through-dom)

Housekeeping

  • CodeQL now scans the dev release branch, not just main — releases ship from dev, so the scanner had never analyzed the actually-released code. The dev baseline is clean.

No schema or workflow changes; this is a drop-in update.

rolester update    # or: npm i -g rolester@0.4.1
Assets 2
Loading