Compare commits

..

2 Commits

Author SHA1 Message Date
Xe Iaso
b729adc6cb chore: spelling
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-07-24 13:58:29 +00:00
Xe Iaso
a0a6b3f147 fix(lib): block XSS attacks via nonstandard URLs
This could allow an attacker to craft an Anubis pass-challenge URL that
forces a redirect to nonstandard URLs, such as the `javascript:` scheme
which executes arbitrary JavaScript code in a browser context when the
user clicks the "Try again" button.

Release-status: cut
Signed-off-by: Xe Iaso <me@xeiaso.net>
2025-07-24 13:54:33 +00:00
4 changed files with 4 additions and 6 deletions

View File

@@ -1 +1 @@
1.21.2 1.21.1

View File

@@ -13,8 +13,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
<!-- This changes the project to: --> <!-- This changes the project to: -->
## v1.21.2: Minfilia Warde - Echo 2
### Fixes ### Fixes
#### Fixes a problem with nonstandard URLs and redirects #### Fixes a problem with nonstandard URLs and redirects

4
package-lock.json generated
View File

@@ -1,12 +1,12 @@
{ {
"name": "@techaro/anubis", "name": "@techaro/anubis",
"version": "1.21.2", "version": "1.21.1",
"lockfileVersion": 3, "lockfileVersion": 3,
"requires": true, "requires": true,
"packages": { "packages": {
"": { "": {
"name": "@techaro/anubis", "name": "@techaro/anubis",
"version": "1.21.2", "version": "1.21.1",
"license": "ISC", "license": "ISC",
"devDependencies": { "devDependencies": {
"cssnano": "^7.1.0", "cssnano": "^7.1.0",

View File

@@ -1,6 +1,6 @@
{ {
"name": "@techaro/anubis", "name": "@techaro/anubis",
"version": "1.21.2", "version": "1.21.1",
"description": "", "description": "",
"main": "index.js", "main": "index.js",
"scripts": { "scripts": {