v1.1.3
BigBodyCobain/Shadowbrokerv1.1.3Oct 5, 2026by wyuc
Upgrading?
AI Summary
A security release addressing XSS vulnerabilities in course documents served via `/api/persistence` by sanitizing HTML to remove scripts, event handlers, and inline styles.
Key Highlights
- Course documents now carry sanitized slide HTML on every write and read to prevent script execution.
- The `/api/persistence` endpoint now applies the same sanitization policy as `/api/classroom`.
- Existing documents are sanitized on subsequent reads and new documents are stored clean.
Breaking Changes
- Slide HTML formatting is reduced (scripts, event-handler attributes, and `javascript:` URLs are removed).
- Inline styles are re-serialized without spaces (e.g., `text-align: center` becomes `text-align:center`).
- Existing stored documents are not rewritten but are sanitized when they are next read.
New Features
- Enhanced security policy for document persistence.
Full Release Notes
A security release. Course documents served by `/api/persistence` now carry only the slide HTML the renderer produces, on every write and every read. Read **Behavior Changes** before upgrading. ## Security - Course documents: with server persistence enabled, `/api/persistence/documents/...` stored and returned slide HTML without sanitizing it. Document reads are capability-by-id, so anyone with a course link loads that course, and the classroom renders slide text, shape text, table cells and LaTeX snapshots as HTML. A course written through this path could therefore run script in the browser of anyone who opened its link. The owner-bound document store now applies the same sanitization policy as `/api/classroom` to the stage and scenes on every write and every read, so new documents are stored clean and documents stored earlier are served clean. [GHSA-6c52-8h4v-5xvg](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-6c52-8h4v-5xvg) [#1799](https://github.com/THU-MAIC/OpenMAIC/pull/1799) The same fix ships in [v1.2.0-rc.1](https://github.com/THU-MAIC/OpenMAIC/releases/tag/v1.2.0-rc.1). ## Behavior Changes - Slide HTML written through `/api/persistence` is reduced to the renderer's formatting vocabulary (the policy `/api/classroom` already applies): scripts, event-handler attributes, `javascript:` URLs and embedded objects are removed, and inline styles are re-serialized without spaces (`text-align: center;` becomes `text-align:center`). Formatting the editor produces is kept. - Documents already stored are not rewritten in the database; they are sanitized when read, and stored clean the next time they are saved.
Related Repositories
public-apis/public-apis★ 491,220
A collective list of free APIs
NousResearch/hermes-agent★ 256,091
The agent that grows with you
yt-dlp/yt-dlp★ 200,268
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,564
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.