XSS fixes in links, images, and more - #705

Merged

nicholasserra merged 15 commits into

trentm:masterfrom

Crozzers:further-xss-fixes

Aug 18, 2026

Commits on May 14, 2026

Fix XSS fromn HTML encoded colons in hrefs
Crozzers
committed
3b96ec1
Fix XSS from making javascript: hrefs look like domains with ports
Crozzers
committed
a11ce82
Fix onerror XSS in image title attr
Crozzers
committed
82b4482

Commits on May 23, 2026

Fix incomplete recursive unhashing of spans
Crozzers
committed
456f8a9
Update github actions versions
Crozzers
committed
c173c12

Commits on May 24, 2026

Fix smuggling XSS into link def URLs
Crozzers
committed
b0dd0b3

Commits on Jun 13, 2026

Fix HTML block hashing messing up if open/close tags not at start of line
Crozzers
committed
c7a75f6

Commits on Jun 14, 2026

Fix links being processed within autolink syntax
Crozzers
committed
e7b0ba1

Commits on Jun 20, 2026

Fix tag balance checkers not accounting for void tags
Crozzers
committed
21eb34b

Commits on Jun 26, 2026

Loosen link-within-autolink check for if link starts OR ends inside autolink
Crozzers
committed
2f0cf2c

Commits on Aug 9, 2026

Fix orphaned closing tags breaking html block hashing
Crozzers
committed
0e3527b

Commits on Aug 18, 2026

Merge branch 'master' into further-xss-fixes
Crozzers
committed
c06b073
Fix SVGs smuggled in autolinks
Crozzers
committed
6e81042
Update changelog
Crozzers
committed
1b5d132
Fix test suite for pygments 2.21
Crozzers
committed
c06f274