ViewFlow v0.9.2

[gauthamnair2005]

[0.9.2] - 2025-12-04

Security

• Fixed DOM-based XSS Vulnerability:
  • Patched static/player.js to strictly validate video URLs and ensure they are assigned only to <video> elements.
  • Replaced direct src property assignment with setAttribute('src', ...) for safer handling.
  • Hardened getSafeVideoUrl to always return canonical absolute URLs, preventing relative path exploits.
  • Resolved CodeQL alert for "DOM text reinterpreted as HTML".

---

This discussion was created from the release ViewFlow v0.9.2.