8 min
From an early break to XSS
One loop in x/net/html's Render trusted its first safe ancestor. Across 2,880 shapes, 240 came back as a live <img>; v0.62.0 closes all of them and escapes 225 that were clean.
Security
1 post.
1 post.
One loop in x/net/html's Render trusted its first safe ancestor. Across 2,880 shapes, 240 came back as a live <img>; v0.62.0 closes all of them and escapes 225 that were clean.