Nitro-V3

mirror of https://github.com/duckietm/Nitro-V3.git synced 2026-06-20 07:26:19 +00:00

Files

T

simoleo89 24d10aced1 fix(security): harden external-link opening (protocol allow-list + noopener)

URLs reached window.open from user/server-controlled content without a protocol check or noopener, allowing reverse-tabnabbing and (for the chat link handler) a javascript:/data: href running in our origin.

- add isSafeExternalUrl() (http/https only) + tests; gate the chat link opener (useOnClickChat) and external photo opener with it

- SanitizeHtml: afterSanitizeAttributes hook forces rel="noopener noreferrer" on any target=_blank anchor (overrides attacker-supplied rel)

- add noopener,noreferrer to the remaining window.open(_blank) sites (YouTube share, external photo, guide forum link); drop a stray console.log

2026-06-17 19:12:01 +02:00

avatar-info

fix(security): sanitize user-controlled HTML in chat & username sinks

2026-06-17 19:00:42 +02:00

chat

fix(security): sanitize user-controlled HTML in chat & username sinks

2026-06-17 19:00:42 +02:00

chat-input

fix(chat): keep flood warning inside the chat bar

2026-06-15 22:35:36 +02:00

choosers

feat(hooks): permission-driven gating via useHasPermission