Gusted dccf180307 disallow javascript: URI in the repository description ... - Fixes an XSS that was introduced in https://codeberg.org/forgejo/forgejo/pulls/1433 - This XSS allows for `href`s in anchor elements to be set to a `javascript:` uri in the repository description, which would upon clicking (and not upon loading) the anchor element execute the specified javascript in that uri. - [`AllowStandardURLs`](https://pkg.go.dev/github.com/microcosm-cc/bluemonday#Policy.AllowStandardURLs) is now called for the repository description policy, which ensures that URIs in anchor elements are `mailto:`, `http://` or `https://` and thereby disallowing the `javascript:` URI. It also now allows non-relative links and sets `rel="nofollow"` on anchor elements. - Unit test added. (cherry picked from commit bb448f3dc2)		2024-08-09 05:57:21 +00:00
..
actions	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
activitypub	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
analyze	…
assetfs	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
auth	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
avatar	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
base	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
cache	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
charset	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
container	…
csv	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
emoji	…
eventsource	…
forgefed	fix review	2024-05-29 18:31:06 +02:00
generate	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
git	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
gitgraph	Add codespell support and fix a good number of typos with its help (#3270)	2024-05-09 13:49:37 +00:00
gitrepo	…
graceful	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
hcaptcha	…
highlight	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
hostmatcher	…
html	…
httpcache	…
httplib	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
indexer	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
issue/template	Support setting the `default` attribute of the issue template dropdown field (#31045)	2024-05-26 20:13:09 +02:00
json	…
label	…
lfs	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
log	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
markup	disallow javascript: URI in the repository description	2024-08-09 05:57:21 +00:00
mcaptcha	…
metrics	Rename project board -> column to make the UI less confusing (#30170)	2024-06-02 09:42:39 +02:00
migration	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
nosql	…
optional	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
options	…
packages	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
paginator	…
pprof	…
private	fix(hook): ignore unknown push options instead of failing	2024-07-02 20:18:33 +00:00
process	Add codespell support and fix a good number of typos with its help (#3270)	2024-05-09 13:49:37 +00:00
proxy	…
proxyprotocol	…
public	…
queue	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
recaptcha	…
references	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
regexplru	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
repository	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
secret	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
session	…
setting	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
sitemap	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
ssh	…
storage	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
structs	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
svg	…
sync	…
system	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
templates	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
test	test(util): MockProtect when mocking multiple times	2024-06-02 15:24:06 +02:00
testlogger	Add codespell support and fix a good number of typos with its help (#3270)	2024-05-09 13:49:37 +00:00
timeutil	…
translation	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
turnstile	…
typesniffer	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
updatechecker	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
uri	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
user	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
util	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
validation	added validation fixes	2024-05-14 08:31:34 +02:00
web	enable linter testifylint on v8 (#4573)	2024-07-30 19:41:27 +00:00
webhook	Add support for workflow_dispatch (#3334)	2024-06-28 05:17:11 +00:00