Semester 1.26

Security fixes. Update when you can.

Windows: assignment text could run commands. A reminder built its notification out of a PowerShell command, and Canvas text went in unquoted, so an assignment or course named a certain way could run code on your computer when the reminder fired. Background reminders run with Semester closed, so it did not need the app open. Notification text is now quoted so nothing in it can execute. Windows only. Mac and Linux were never affected.

The local API answered other websites. Semester runs a small server on your own computer to draw the dashboard. It did not check where a request came from, so any page open in your browser could tell it to submit work, send a Canvas message, or log you out, and a site that pointed its own name at your computer could read your inbox and grades through it. Requests from other sites and from other hostnames are now refused.

Assignment descriptions are cleaned before display. A description is a teacher's HTML and the dashboard shows it as HTML. Formatting, links, images, lists and tables still render; anything that could run does not.

The checks that run before every build now cover all three, so they cannot come back unnoticed.