Gusted bb448f3dc2 disallow javascript: URI in the repository description ... - Fixes an XSS that was introduced in https://codeberg.org/forgejo/forgejo/pulls/1433 - This XSS allows for `href`s in anchor elements to be set to a `javascript:` uri in the repository description, which would upon clicking (and not upon loading) the anchor element execute the specified javascript in that uri. - [`AllowStandardURLs`](https://pkg.go.dev/github.com/microcosm-cc/bluemonday#Policy.AllowStandardURLs) is now called for the repository description policy, which ensures that URIs in anchor elements are `mailto:`, `http://` or `https://` and thereby disallowing the `javascript:` URI. It also now allows non-relative links and sets `rel="nofollow"` on anchor elements. - Unit test added.		2024-08-09 07:04:01 +02:00
..
actions	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
activitypub	feat: access ActivityPub client through interfaces to facilitate mocking in unit tests (#4853)	2024-08-07 05:45:24 +00:00
analyze
assetfs	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
auth	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
avatar	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
base	cherry-pick OIDC changes from gitea (#4724)	2024-08-08 06:32:14 +00:00
cache	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
charset	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
container	Add container.FilterSlice function (gitea#30339)	2024-04-16 11:49:44 +02:00
csv	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
emoji
eventsource	Final round of db.DefaultContext refactor (#27587)	2023-10-14 08:37:24 +00:00
forgefed	Adjust codespell config + make it fix few typos which sneaked in since addition of codespell support (#4857)	2024-08-08 16:07:35 +00:00
generate	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
git	feat: highlighted code search results (#4749)	2024-08-06 05:57:25 +00:00
gitgraph	Add codespell support and fix a good number of typos with its help (#3270)	2024-05-09 13:49:37 +00:00
gitrepo	Move get/set default branch from git package to gitrepo package to hide repopath (#29126)	2024-03-11 23:36:59 +07:00
graceful	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
hcaptcha
highlight	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
hostmatcher	Support allowed hosts for webhook to work with proxy (#27655)	2023-10-18 09:44:36 +00:00
html
httpcache	[BRANDING] add X-Forgejo-* headers	2024-02-05 16:02:14 +01:00
httplib	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
indexer	Adjust codespell config + make it fix few typos which sneaked in since addition of codespell support (#4857)	2024-08-08 16:07:35 +00:00
issue/template	Issue Templates: add option to have dropdown printed list (#31577)	2024-07-22 15:44:13 +02:00
json
label
lfs	Distinguish LFS object errors to ignore missing objects during migration (#31702)	2024-08-04 18:24:10 +02:00
log	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
markup	disallow javascript: URI in the repository description	2024-08-09 07:04:01 +02:00
mcaptcha
metrics	Rename project board -> column to make the UI less confusing (#30170)	2024-06-02 09:42:39 +02:00
migration	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
nosql	s/Gitea/Forgejo in various log messages and comments	2024-04-21 21:26:15 +05:00
optional	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
options
packages	Arch packages implementation (#4785)	2024-08-04 06:16:29 +00:00
paginator
pprof
private	fix(hook): ignore unknown push options instead of failing	2024-07-02 21:39:01 +02:00
process	Add codespell support and fix a good number of typos with its help (#3270)	2024-05-09 13:49:37 +00:00
proxy
proxyprotocol
public	Refactor CORS handler (#28587)	2023-12-25 20:13:18 +08:00
queue	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
recaptcha
references	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
regexplru	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
repository	Distinguish LFS object errors to ignore missing objects during migration (#31702)	2024-08-04 18:24:10 +02:00
secret	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
session	Avoid importing modules/web/middleware in modules/session (#30584)	2024-04-21 16:28:16 +02:00
setting	Revert "Open telemetry integration (#3972)"	2024-08-07 11:22:43 +02:00
sitemap	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
ssh	Remove SSH workaround (#27893)	2023-11-03 15:21:05 +00:00
storage	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
structs	Adjust codespell config + make it fix few typos which sneaked in since addition of codespell support (#4857)	2024-08-08 16:07:35 +00:00
svg
sync
system	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
templates	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
test	test(util): MockProtect when mocking multiple times	2024-06-02 15:24:06 +02:00
testlogger	Add codespell support and fix a good number of typos with its help (#3270)	2024-05-09 13:49:37 +00:00
timeutil	Remove the time-since class (#29826)	2024-03-20 08:46:30 +01:00
translation	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
turnstile
typesniffer	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
updatechecker	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
uri	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
user	test: enforce tenv usage in tests	2024-07-17 23:07:41 +02:00
util	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
validation	added validation fixes	2024-05-14 08:31:34 +02:00
web	Add testifylint to lint checks (#4535)	2024-07-30 19:41:10 +00:00
webhook	Add support for workflow_dispatch (#3334)	2024-06-28 05:17:11 +00:00