Skip to content

Improve resource handling reliability and security - #2215

Merged
bsweeney merged 9 commits into
developfrom
resource-handling
Aug 30, 2020
Merged

bsweeney merged 9 commits into
developfrom
resource-handling

Conversation

@bsweeney

Copy link
Copy Markdown
Member

No description provided.

Some web servers do not interpret dot-relative paths or interpret them as malicious resulting in an error response from the server.
If the user specifies a custom root then the default stylesheet should be pulled from that directory.
..reparse the computed value in the getter and return the URI
Should always be using the getter from the callee.
Since we're not rendering the image (including the broken-ref image) we should calculate the width/height similar to how we calculate it for normal bullets.
@bsweeney bsweeney added this to the 0.8.6 milestone Aug 29, 2020
@bsweeney
bsweeney merged commit ed3a46a into develop Aug 30, 2020
@bsweeney
bsweeney deleted the resource-handling branch August 30, 2020 13:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Document stylesheet inherits domain context of immediate previous remote stylesheet Information disclosure vulnerability in version 0.8.5 and earlier

1 participant

Sponsor
SponsoredKunjungi sekarang
Promo