Compare commits

..

2 Commits

Author SHA1 Message Date
Xe Iaso
b729adc6cb chore: spelling
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-07-24 13:58:29 +00:00
Xe Iaso
a0a6b3f147 fix(lib): block XSS attacks via nonstandard URLs
This could allow an attacker to craft an Anubis pass-challenge URL that
forces a redirect to nonstandard URLs, such as the `javascript:` scheme
which executes arbitrary JavaScript code in a browser context when the
user clicks the "Try again" button.

Release-status: cut
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-07-24 13:54:33 +00:00
4 changed files with 4 additions and 6 deletions

View File

@@ -1 +1 @@
1.21.2
1.21.1

View File

@@ -13,8 +13,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
<!-- This changes the project to: -->
## v1.21.2: Minfilia Warde - Echo 2
### Fixes
#### Fixes a problem with nonstandard URLs and redirects

4
package-lock.json generated
View File

@@ -1,12 +1,12 @@
{
"name": "@techaro/anubis",
"version": "1.21.2",
"version": "1.21.1",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "@techaro/anubis",
"version": "1.21.2",
"version": "1.21.1",
"license": "ISC",
"devDependencies": {
"cssnano": "^7.1.0",

View File

@@ -1,6 +1,6 @@
{
"name": "@techaro/anubis",
"version": "1.21.2",
"version": "1.21.1",
"description": "",
"main": "index.js",
"scripts": {