mirror of
https://github.com/withastro/astro.git
synced 2025-02-24 22:46:02 -05:00
ca335e1dc0
* Fix an XSS in Server Islands. Discussed with @FredKSchott that this is OK to disclose since Server Islands are still experimental. It's generally not safe to use `JSON.stringify` to interpolate potentially attacker controlled data into `<script>` tags as JSON doesn't escape `<>"'` and so one can use it to break out of the script tag and e.g. make a new one with controlled content. See https://pragmaticwebsecurity.com/articles/spasecurity/json-stringify-xss * Format * Create smart-snakes-promise.md * Switch to manual encoding --------- Co-authored-by: Matt Kane <m@mk.gg> |
||
|---|---|---|
| .. | ||
| astro | ||
| astro-prism | ||
| astro-rss | ||
| create-astro | ||
| db | ||
| integrations | ||
| internal-helpers | ||
| markdown/remark | ||
| studio | ||
| telemetry | ||
| underscore-redirects | ||
| upgrade | ||