Skip to content

v2.4.1

Choose a tag to compare

View all tags
@robrigo robrigo released this 17 Aug 22:51
· 6 commits to main since this release
v2.4.1
437300b
This commit was signed with the committer’s verified signature.
robrigo Robrigo
SSH Key Fingerprint: /txu240/4jXyQ4o32GtThUpKU46UI5zJ2WQe4BzLPMU
Verified
Learn about vigilant mode.

Refuses a path id that would send the request somewhere else.

Bug fixes

  • An empty id, ., or .. passed to an Explorer method that puts it in a path segment now throws before the request. encodeURIComponent leaves a dot alone, so the URL parser inside fetch used to resolve the segment away and read a neighbouring route on the same origin: getRoyaltyAccount('..') requested /v1/royalties/, and an empty id turned a single-row route into its list. The thirteen readers that take an id or a name in the path, over sales, auctions, buy-offers, marketplaces, royalties, assets, and offers, all carry the check. (#25)

Commits

  • 56317a2 chore(package): carry the author URL and publishConfig, and state the metadata the npm page reads (#24)
  • 2991873 fix: refuse an empty or dot path id so a request cannot land on a sibling route (#25)
  • 437300b chore(release): 2.4.1

Full changelog: v2.4.0...v2.4.1

Assets 2
Loading