Skip to content

v0.1.3

Choose a tag to compare

View all tags
@engels74 engels74 released this 30 Dec 18:24
· 209 commits to main since this release
0.1.3
2224277
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security Fixes

This release addresses two security vulnerabilities:

Authorization Bypass (High Severity)

  • Fixed an authorization bypass in the user wrapped page (/wrapped/[year]/u/[identifier]) that allowed unauthorized access when using numeric user IDs instead of share tokens
  • Unauthorized access now properly returns 403/404 responses

Stored XSS Prevention (Critical Severity)

  • Added HTML sanitization for custom slide markdown content using sanitize-html
  • All markdown output is now sanitized before rendering to prevent script injection
  • Implemented strict allowlist for safe HTML tags, attributes, and URL schemes
  • Added MIME type validation for data URIs in images

Dependency Updates

  • Updated unocss from 66.5.11 to 66.5.12
  • Updated svelte-adapter-bun from 1.0.0 to 1.0.1

Breaking Changes

  • Custom slides will no longer allow arbitrary HTML; content is sanitized according to a strict allowlist of safe tags and attributes
Assets 2
Loading