Skip to content

Commit 1365e5a

Browse files
committed
Add spacing after the markdown headers.
1 parent 0a22479 commit 1365e5a

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

gems/phlex/GHSA-g7xq-xv8c-h98c.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ title: Cross-site Scripting (XSS) possible due to improper sanitisation of `href
66
date: 2024-04-16
77
description: |
88
### Summary
9+
910
There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.
1011
1112
Our filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`.
@@ -31,6 +32,7 @@ description: |
3132
- [1.4.2](https://rubygems.org/gems/phlex/versions/1.4.2)
3233
3334
### Workarounds
35+
3436
Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited.
3537
3638
cvss_v3: 7.1

0 commit comments

Comments
 (0)