Skip to content
This repository was archived by the owner on May 29, 2026. It is now read-only.

Add escaping for bad platform string.#10

Merged
biw merged 3 commits into
mainfrom
flohdot/master
Mar 17, 2021
Merged

Add escaping for bad platform string.#10
biw merged 3 commits into
mainfrom
flohdot/master

Conversation

@biw

@biw biw commented Mar 17, 2021

Copy link
Copy Markdown
Owner

Mitigates XSS on bad download URLs such as https://YOUR.NUTS.URL/download/version/2.0.0/%3Cimg%20src=x%20onerror=alert(1)%3E
and https://YOUR.NUTS.URL/download/channel/alpha/%3Cimg%20src=x%20onerror=alert(1)%3E

I don't see anywhere I could just insert a test for this in the existing suite.

From GitbookIO/nuts#138

@biw
biw merged commit 2a7ae8a into main Mar 17, 2021
@biw
biw deleted the flohdot/master branch March 17, 2021 03:17
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants