Fix XSS by parsing player counts as raw data and validating favicon URIs (#116)

* Fix XSS by parsing player counts as raw data (instead of parsing it)

* Ensure the returned favicon is a data URI

* Force server favicon size to 64px

* Increase specificity of data URI validation

The previous commit would happily accept any domain (or subdomain) that started with "data"

This commit is contained in:

Hugo Manrique

2019-09-05 23:15:44 +02:00

committed by

Crypt

parent 6da613bbb8

commit 0392fce6c3

3 changed files with 15 additions and 6 deletions

1

.eslintignore Normal file

View File

				`@ -0,0 +1 @@`
				`*`

Fix XSS by parsing player counts as raw data and validating favicon URIs (#116)

1 .eslintignore Normal file Unescape Escape View File

1

.eslintignore Normal file

View File