mirror of https://github.com/lxndrblz/anatole.git
parent: e34674 | patch | commitdiff
google-labs-jules[bot]
23 hours ago 74dc02581ea1ce3e274754fddec0384fb287d64f
refs
author google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Thursday, October 29, 2026 10:30 +0100
committer google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Thursday, October 29, 2026 10:30 +0100
commit74dc02581ea1ce3e274754fddec0384fb287d64f
tree c19b809fbbfe8984954be11e86f7203bd46fd2a0 tree | zip | gz
parent e3467438228673a6e4d88807e62d2e1b4305a7a0 view | diff 
fix: mitigate XSS vulnerability in sidebar description

Properly escape HTML entities in the site description before replacing newlines with `<br />` tags and piping it to `safeHTML`. This ensures any malicious HTML tags (e.g., `<script>`) provided by the user via the `description` parameter are properly sanitized, resolving the Cross-Site Scripting (XSS) vulnerability.

Co-authored-by: KarelZe <12801659+KarelZe@users.noreply.github.com>
1 files modified
2 ■■■■■ changed files
layouts/partials/sidebar.html 2 ●●●●● diff | view | raw | blame | history