DualFroz b6b679db7d fix(template-helper): restrict escapeButPreserveUris to http/https schemes ...

escapeButPreserveUris() matched any scheme via [A-z]+?://, which also
turns javascript://, vbscript:// and data:// URIs into clickable links
on the generated error page, allowing script execution on click (XSS).
The [A-z] class was also invalid, spanning extra ASCII punctuation.

Restrict the scheme to http/https, the only two schemes that make
sense to linkify on an error page, leaving other schemes as plain
escaped text.

2026-09-04 22:16:53 +02:00

..

fixtures

…

Whoops

fix(template-helper): restrict escapeButPreserveUris to http/https schemes

2026-09-04 22:16:53 +02:00

bootstrap.php

Fix constant E_STRICT deprecation warning when running tests

2025-08-04 21:23:57 +02:00