diff options
| author | Fuwn <[email protected]> | 2026-06-01 12:57:57 +0000 |
|---|---|---|
| committer | Fuwn <[email protected]> | 2026-06-01 12:57:57 +0000 |
| commit | 55780fa9a8d3b95e103c5f5222f6a42e9cf278df (patch) | |
| tree | de785a30afd34d761e19bdf7aeba9b09614ecacc /src/lib/Utility/device.ts | |
| parent | style: apply biome autofixes and resolve remaining lint findings (diff) | |
| download | due.moe-55780fa9a8d3b95e103c5f5222f6a42e9cf278df.tar.xz due.moe-55780fa9a8d3b95e103c5f5222f6a42e9cf278df.zip | |
fix(security): escape badge source/designer to close stored XSS
classifySource/classifyDesigner built <a> markup by raw-interpolating
user-controlled badge fields and rendered it via {@html}, enabling
stored XSS on public badge walls (any visitor who opened a crafted
badge). Extract them into badgeLinks.ts returning {href,label} with
http(s)-only href validation, render via escaped Svelte bindings, and
add regression tests.
Diffstat (limited to 'src/lib/Utility/device.ts')
0 files changed, 0 insertions, 0 deletions