elie/android-foss
1
0
Fork 0
mirror of https://github.com/offa/android-foss.git synced 2026-07-21 17:35:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): rendering mutable remote content from branch head (#639)

Browse Source 
The app fetches Markdown from `.../master/README.md`, which is a mutable branch reference. Content can change at any time and is immediately rendered client-side. This increases risk of unexpected content/script injection and makes output non-reproducible.

Affected files: index.html

Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
This commit is contained in:
tomaioo
2026-04-15 19:39:35 +00:00
committed by GitHub
parent adba20d989
commit d3e32a78a2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
index.html
+1 -1
View File
@@ -51,7 +51,7 @@
marked.use( markedGfmHeadingId.gfmHeadingId() ); marked.use( markedGfmHeadingId.gfmHeadingId() );
// Get the markdown file, convert it to HTML & put it inside the main tag // Get the markdown file, convert it to HTML & put it inside the main tag
fetch( 'https://raw.githubusercontent.com/offa/android-foss/master/README.md' ) fetch( 'README.md' )
.then( response => response.text() ) .then( response => response.text() )
.then( data => { .then( data => {
document.querySelector( 'main' ).innerHTML = marked.parse( data ); document.querySelector( 'main' ).innerHTML = marked.parse( data );