Release v2.17.1 - Security Patch · thewpminute/PodLoom

What's Changed

Security patch. Hardens RSS description rendering, the transcript proxy, image caching, and public AJAX endpoints. Recommended for all users.

HTML Sanitization: Centralized RSS description sanitization (podloom_sanitize_rss_description_html()) strips javascript:, data:, and vbscript: hrefs and adds rel="noopener noreferrer" to external links; replaces three duplicated sanitization blocks
Transcript Proxy: Enforces http/https scheme after URL validation, adds wp_http_validate_url() as a second SSRF layer, caps response size via limit_response_size before reading body into memory, checks Content-Length header
Image Cache: URL validated with esc_url_raw + wp_http_validate_url + scheme check before any fetch; limit_response_size added to request args; Content-Length header checked before reading body
Image Cache AJAX: Endpoint now requires a valid podloom_image_cache_nonce nonce (HTTP 403 on failure); queue items validated for required fields before processing
Pagination: Public episode AJAX endpoints clamp limit to max(1, min(x, 50)) to prevent division-by-zero edge cases
Episode Ingest: Episode description and content sanitized at cache time in refresh_feed_with_data() and re-sanitized on read in get_episodes() for defense-in-depth on legacy cached data
Block Editor: Client-side sanitizeHtmlForPreview() sanitizer added to episode block editor preview, replacing raw dangerouslySetInnerHTML binding