Skip to content

Release v1.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 13:59
· 17 commits to main since this release
v1.9.0
98a94a7

v1.9.0

Changelog

Security: URLs whose authority PHP and QR scanners read differently (backslash, userinfo, control chars) are rejected. See UPGRADING.

Security

  • URL allowlist bypass through ambiguous authorities. QrUrlPolicy took the host from PHP parse_url(), which
    reads backslashes and userinfo differently from browsers and QR scanners: https://evil.tld\.good.com/ (host
    evil.tld\.good.com for PHP) and https://evil.tld\@good.com/ (host good.com for PHP) passed a good.com
    allowlist but open evil.tld on a phone, defeating the anti-phishing allowlist for user-supplied URLs. URLs with a
    backslash, control character or whitespace, with userinfo (user@, user:pass@), or whose host is not a plain DNS
    name / IPv4 / bracketed IPv6 literal (percent-encoded or Unicode hosts) are now rejected, with or without an
    allowlist. See UPGRADING.
Assets 2
Loading