public_git/bambuddy
1
0
Fork 0
mirror of https://github.com/maziggy/bambuddy.git synced 2026-10-18 11:56:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix stored XSS vulnerabilities and unauthenticated auth toggle

Browse Source 
- Sanitize project notes with DOMPurify before rendering via
    dangerouslySetInnerHTML (ProjectDetailPage.tsx)
  - Replace hand-rolled HTML sanitizer with DOMPurify in ProjectPageModal
    to prevent attribute injection via crafted 3MF href values
  - Block /api/v1/auth/setup when auth is already enabled to prevent
    unauthenticated clients from disabling authentication remotely
This commit is contained in:
maziggy
2026-03-15 15:31:49 +01:00
parent 0feed83ce4
commit fa6edfbcde
8 changed files with 479 additions and 491 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/assets/index-jwN56PpH.js → static/assets/index-CyeSJFXC.js
+443 -442
View File
File diff suppressed because one or more lines are too long
static/index.html
+1 -1
View File
@@ -23,7 +23,7 @@
<!-- Splash screens for iOS -->
<link rel="apple-touch-startup-image" href="/img/android-chrome-512x512.png" />
<script type="module" crossorigin src="/assets/index-jwN56PpH.js"></script>
<script type="module" crossorigin src="/assets/index-CyeSJFXC.js"></script>
<link rel="stylesheet" crossorigin href="/assets/index-BgeMokkR.css">
</head>
<body>