Skip to content

0.4.1

Choose a tag to compare

View all tags
@amelandri amelandri released this 29 Aug 11:14
· 70 commits to main since this release
v0.4.1
cefddee

Security

  • The avatar and display-name links on each post (added after 0.3's profile-link feature) only HTML-escaped account.url, unlike the existing @username link — a remote account could set a javascript: URI as its profile URL and get it executed when a viewer clicked the avatar or name. All three profile links now share one isHttpUrl() scheme check.
Assets 2
Loading