Skip to content

v0.5.1 — complete the bad-tag-filter fix

Choose a tag to compare

View all tags
@scttbnsn scttbnsn released this 30 Jun 23:17
v0.5.1
fa1f160

A one-line security patch. The 0.4.1 HTML-stripper fix used </script\s*>, which still misses real end tags like </script bar> (an HTML parser closes the element on </script + any non-> chars + >). htmlToText now uses [^>]* so script/style stripping can't be bypassed. Caught by CodeQL's PR diff (js/bad-tag-filter).

rolester update    # or: npm i -g rolester@0.5.1
Assets 2
Loading