quasarframework/quasar quasar-v2.35.4 on GitHub

Security fixes

fix(Body): SSR brand colors could inject HTML or CSS -> on SSR, the config.brand colors are written into a <style> tag in the page head, and their names and values went in as-is. A value containing </style> closed the tag and whatever followed became page markup (a <script> included), while one containing } or ; could add CSS rules of its own. A brand color whose name or value contains <, {, } or ; is now left out of the server-rendered page, as no CSS color needs these characters. Only apps passing untrusted data as brand colors on the server were exposed; a brand set in the quasar.config file is not attacker-controlled
fix(Lang): SSR language pack isoName could inject HTML -> on SSR, the isoName of the active language pack is written as the lang attribute of the <html> tag, unquoted and unescaped, so a name containing a space or > could add attributes to the tag or close it and inject markup. The lang attribute is now set only when isoName is a language tag (hyphen-separated groups of letters and digits, like en-US); otherwise only dir is. The client follows the same rule and removes the lang attribute for such a pack. Only apps building the language pack object from untrusted data were exposed; the packs shipped with Quasar are not affected, even when picked based on a request header or cookie. Behavior change: a custom pack whose isoName is not a language tag (en_US, or a missing one, which used to render lang=undefined) no longer gets a lang attribute

Fixes

fix(QTable/QTree/QField/QPopupEdit): memory leak in Chrome -> the first instance of these components to render a scoped slot was kept in memory for the lifetime of the page after being unmounted, along with its rows, vnodes and detached DOM. Chrome 153+ never releases the first getter defined on such a slot scope object, and that getter held on to the component instance. The props of the slot scopes (expand, selected, value, expanded, ticked, indeterminate, field) work as before (#18577)

Other

perf(Meta): SSR escaping -> the script and noscript content written by the Meta plugin on SSR no longer builds a regular expression on each call

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following: