Compare commits

..

2 Commits

Author SHA1 Message Date
Xe Iaso
5700512da5 chore: release v1.21.2
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-07-24 10:47:32 -04:00
Xe Iaso
d40e9056bc fix(lib): block XSS attacks via nonstandard URLs (#904)
* fix(lib): block XSS attacks via nonstandard URLs

This could allow an attacker to craft an Anubis pass-challenge URL that
forces a redirect to nonstandard URLs, such as the `javascript:` scheme
which executes arbitrary JavaScript code in a browser context when the
user clicks the "Try again" button.

Release-status: cut
Signed-off-by: Xe Iaso <me@xeiaso.net>

* chore: spelling

Signed-off-by: Xe Iaso <me@xeiaso.net>

---------

Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-07-24 14:05:00 +00:00
4 changed files with 6 additions and 4 deletions

View File

@@ -1 +1 @@
1.21.1
1.21.2

View File

@@ -13,6 +13,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
<!-- This changes the project to: -->
## v1.21.2: Minfilia Warde - Echo 2
### Fixes
#### Fixes a problem with nonstandard URLs and redirects

4
package-lock.json generated
View File

@@ -1,12 +1,12 @@
{
"name": "@techaro/anubis",
"version": "1.21.1",
"version": "1.21.2",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "@techaro/anubis",
"version": "1.21.1",
"version": "1.21.2",
"license": "ISC",
"devDependencies": {
"cssnano": "^7.1.0",

View File

@@ -1,6 +1,6 @@
{
"name": "@techaro/anubis",
"version": "1.21.1",
"version": "1.21.2",
"description": "",
"main": "index.js",
"scripts": {