ben/Open-Streaming
Watch
1
0
Fork
You've already forked Open-Streaming
 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions
7 releases 7 tags
  • v1.1.0 10f395df13

    v1.1.0 Stable

    ben released this 2026-07-15 10:25:45 -07:00 | 4 commits to main since this release

    Fixed Security Vulnerabilities:

    Critical - XSS (cross-site scripting)

    createServiceEl built tiles with innerHTML and unescaped label/img/url. A config with a label like would run arbitrary JavaScript. Rewrote it entirely using createElement/textContent/setAttribute so nothing is ever interpreted as HTML.
    The edit path had the same hole via fallback.outerHTML — now rebuilds the tile safely.

    High - unsafe URLs

    openService set window.location.href to any string, so a javascript: URL would execute. Added isSafeUrl() which only allows http:/https:.
    Custom service inputs now validate the URL and image on entry.

    High - unvalidated import

    Import wrote raw JSON straight to localStorage. Now every field is validated: services are filtered and sanitized, URLs/images checked, theme/size/mode values checked against allowlists, custom theme colors must be valid hex, and there's a 5MB file cap.

    Medium - CSS injection & file validation

    Background image URL now rejects quotes/parens that could break out of url('...').
    Image upload validates the MIME type is actually an image and caps size at 5MB.

    Fixed UI issues when running on screens smaller than 1920x1080.

    Downloads