fix(security): rendering mutable remote content from branch head (#639)

The app fetches Markdown from `.../master/README.md`, which is a mutable branch reference. Content can change at any time and is immediately rendered client-side. This increases risk of unexpected content/script injection and makes output non-reproducible.

Affected files: index.html

Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
This commit is contained in:
tomaioo
2026-04-15 19:39:35 +00:00
committed by GitHub
parent adba20d989
commit d3e32a78a2
+1 -1
View File
@@ -51,7 +51,7 @@
marked.use( markedGfmHeadingId.gfmHeadingId() );
// Get the markdown file, convert it to HTML & put it inside the main tag
fetch( 'https://raw.githubusercontent.com/offa/android-foss/master/README.md' )
fetch( 'README.md' )
.then( response => response.text() )
.then( data => {
document.querySelector( 'main' ).innerHTML = marked.parse( data );