Security
- Fixed a stored cross-site scripting vulnerability in Markdown rendering.
- Breaking change: User-authored inline HTML, CSS, and JavaScript no longer render in Markdown documents. Wiki-Go Markdown extensions remain supported.
- Affected versions: v1.2.0 through v1.8.13.
- Upgrade to v1.9.0 or later.
- Reported by @0xbassiouny1337.
- See GHSA-fwwj-gjg9-65gr for details.
New feature
- Chapter links sidebar by @cmatsuoka
Commits
- Merge pull request #187 from leomoon-studios/dev (4fd20d9 by Amin Persia)
- Adds close chapter-links on mobile on outside tap (d41e277 by Amin Persia)
- Merge secure chapter links integration into dev (ef2d3e5 by Amin Persia)
- Add permanent security and regression coverage (f6c574e by Amin Persia)
- Localizes and hardens the panel controls (80aaf9c by Amin Persia)
- Preserve inline TOC behavior with chapter links and refine styling (4d317a5 by Amin Persia)
- Makes chapter links state CSP compatible (19c2872 by Amin Persia)
- Safely render chapter links from typed headings (e458284 by Amin Persia)
- Exposes trusted chapter heading metadata (42d5033 by Amin Persia)
- Merge PR #186 chapter links into dev (bd0b128 by Amin Persia)
- Make the side panel tab movable on mobile (02c856d by Claudio Matsuoka)
- Fix side panel on mobile (def3ed7 by Claudio Matsuoka)
- Use retracted instead of collapsed for chapter links panel (915aca9 by Claudio Matsuoka)
- Refactor code block mark detection (ec3445d by Claudio Matsuoka)
- Make page title bold in the side panel (919bd33 by Claudio Matsuoka)
- Fix rearrangement of side panel contents (7e8054c by Claudio Matsuoka)
- Add show/retract button to chapter links side panel (55b7e6d by Claudio Matsuoka)
- Implement chapter links (55d38d2 by Claudio Matsuoka)
- Prepare for the chapter links feature (5c5e605 by Claudio Matsuoka)
- Updates SECURITY.md (6cb2ee5 by Amin Persia)
- Fixes bad links indicator regression (e1f1228 by Amin Persia)
- Security: harden sessions and trusted proxy handling (2449c3b by Amin Persia)
- Fixes regression on favicons not loading in link pages (f698857 by Amin Persia)
- Security (csp): enforce a restrictive page security policy (c8db525 by Amin Persia)
- Security (svg): replace regex sanitization with an XML allowlist (f16f2ab by Amin Persia)
- Security (html): restrict trusted HTML conversion points (b7a790a by Amin Persia)
- Fixes shortcode regression (713edfa by Amin Persia)
- Security (markdown): disable raw HTML in document renderers (f893388 by Amin Persia)
- Fixes github style admonition regression (a9b71d5 by Amin Persia)
- Security (markdown): harden kanban and links rendering (e707a62 by Amin Persia)
- Security (markdown): safely render formatting and navigation extensions (1a5faaf by Amin Persia)
- Security (markdown): validate and safely render media extensions (73d415a by Amin Persia)
- Security (markdown): safely render direction and Mermaid blocks (71ac014 by Amin Persia)
- Security (markdown): add trusted nodes for Wiki-Go extensions (8eb0961 by Amin Persia)
- Security (markdown): render comments without unsafe HTML (d3b0132 by Amin Persia)
- Updates rest-api-examples.http file (6e57ef2 by Amin Persia)
- PR 181 follow up (c8d7538 by Amin Persia)
- Improve side panel expand/collapse behavior (#181) (2677ab6 by Claudio Matsuoka)