Erik Michelson dd40a6c04b fix(auth): sanitize email addresses ...

Previously, maliciously crafted email addresses
could be used to sneak HTML code into the HedgeDoc
editor, since HedgeDoc uses the local part of the
address as a display name for users.
We're now sanitizing this using DOMPurify.

Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>

2026-06-18 23:56:45 +02:00

..

config

feat(rate-limit): add more config options

2026-06-17 21:08:07 +02:00

migrations

chore(eslint): run eslint --fix

2025-02-01 22:15:54 +01:00

models

fix(auth): sanitize email addresses

2026-06-18 23:56:45 +02:00

ot

fix(ot): keep pendingOps in StaleWithBuffer during applyClient

2026-03-24 21:12:41 +01:00

web

feat(rate-limit): add more config options

2026-06-17 21:08:07 +02:00

workers

Adapt code for eslint-config-standard 17

2022-05-01 21:19:44 +02:00

csp.js

refactor(embeds): drop slideshare, use vimeo api, tighten CSP

2025-04-10 00:21:55 +02:00

errors.js

feat: rate-limiting

2025-02-01 21:12:08 +01:00

history.js

refactor: use user-token for historyDelete too

2025-11-26 19:28:53 +01:00

letter-avatars.js

fix(editor): always use random hex colors

2026-02-18 19:43:33 +01:00

links.js

feat(editor): add external link warning page

2026-06-10 20:15:09 +02:00

logger.js

Fix eslint warnings

2019-05-31 00:30:29 +02:00

prometheus.js

Add custom prometheus metrics

2021-04-25 20:06:56 +02:00

realtime.js

fix(realtime): aboard finishConnection if user is missing

2026-02-21 23:47:53 +01:00

response.js

chore(deps): upgrade dependencies, remove some unnecessary ones

2025-11-24 14:32:24 +01:00

utils.js

Ensure case-sensitive DB queries on MySQL/MariaDB

2024-09-01 13:54:18 +02:00