arian/anubis-mirror
1
0
Fork 0
mirror of https://github.com/TecharoHQ/anubis.git synced 2026-04-24 00:56:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(lib): block XSS attacks via nonstandard URLs (#904)

Browse Source 
* fix(lib): block XSS attacks via nonstandard URLs

This could allow an attacker to craft an Anubis pass-challenge URL that
forces a redirect to nonstandard URLs, such as the `javascript:` scheme
which executes arbitrary JavaScript code in a browser context when the
user clicks the "Try again" button.

Release-status: cut
Signed-off-by: Xe Iaso <me@xeiaso.net>

* chore: spelling

Signed-off-by: Xe Iaso <me@xeiaso.net>

---------

Signed-off-by: Xe Iaso <me@xeiaso.net>
This commit is contained in:
Xe Iaso
2025-07-24 10:05:00 -04:00
committed by GitHub
parent 21f570962c
commit d40e9056bc
5 changed files with 98 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/actions/spelling/allow.txt
+2 -1
View File
@@ -3,4 +3,5 @@ https
ssh
ubuntu
workarounds
rjack
rjack
msgbox