* release(desktop): release v1.11.0
* docs(desktop): restore mobile release inputs
* fix(desktop): use js-yaml ESM exports
* fix(desktop): use js-yaml ESM exports
* fix(desktop): package jsdom runtime dependencies
* fix(desktop): package jsdom runtime dependencies
* fix(desktop): use js-yaml ESM exports for Windows metadata
* build(deps): bump actions/setup-node from 6 to 7 (#5046)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(ssr): escape hydration data in inline scripts
* fix(ssr): restore shared user profiles
* fix: make Codex worktree setup portable
* fix(mobile): restore dark mode text colors
* fix(styles): avoid DaisyUI border token collision
* fix(desktop): restore category chevron rotation
* fix(subscription): recover past-due Stripe checkout
* fix(desktop): dismiss share popover after actions
* fix(mobile): handle RSSHub subscription limit errors
* fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056)
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
* chore(ci): format integration URL scheme test
* fix(mobile): use product IDs for Apple IAP verification
* docs(desktop): prepare release inputs
* docs(mobile): prepare release metadata
* release(mobile): release v0.5.7
* docs(mobile): restore desktop release inputs
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sebastion <sebastion@sebastion.dev>
* release(mobile): release v0.5.6
* docs(mobile): restore desktop release inputs
* fix(desktop): use js-yaml ESM exports
* fix(desktop): package jsdom runtime dependencies
* fix(desktop): use js-yaml ESM exports for Windows metadata
* build(deps): bump actions/setup-node from 6 to 7 (#5046)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(ssr): escape hydration data in inline scripts
* fix(ssr): restore shared user profiles
* fix: make Codex worktree setup portable
* fix(mobile): restore dark mode text colors
* fix(styles): avoid DaisyUI border token collision
* fix(desktop): restore category chevron rotation
* fix(subscription): recover past-due Stripe checkout
* fix(desktop): dismiss share popover after actions
* fix(mobile): handle RSSHub subscription limit errors
* fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056)
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
* chore(ci): format integration URL scheme test
* fix(mobile): use product IDs for Apple IAP verification
* docs(desktop): prepare release inputs
* docs(mobile): prepare release metadata
* release(desktop): release v1.12.0
* docs(desktop): restore mobile release inputs
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sebastion <sebastion@sebastion.dev>
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
DIYgod
github-actions[bot]
DIYgod
Sebastion
dependabot[bot]
Tony