Skip to content

Release v1.9.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 15:15
· 14 commits to main since this release
v1.9.1
d953341

v1.9.1

Changelog

Security: url_allowlist_required applies to every profile; admin regex patterns are validated. See UPGRADING.

Security

  • url_allowlist_required applies to every profile. The compile-time check only saw the YAML default profile;
    other YAML profiles and database profiles edited in the admin could encode any URL. createDataUriForUrl() now
    refuses a profile without an allowlist when url_allowlist_required is true.
  • Admin regex patterns are validated. #…# allowlist patterns that do not compile or nest quantifiers (ReDoS on
    every render) are rejected by the profile form; an invalid stored pattern never matches (no warning / 500).
Assets 2
Loading