Starstruk Logo MarkStarstruk

1.0.8.5

konvajs/konva1.0.8.5Jun 7, 2026by givanz

AI Summary

This update prioritizes security by sanitizing user inputs (bio, theme name) and removing insecure file permissions, while also adding field templates and fixing URL validation to prevent private network redirects.

Key Highlights

  • Sanitized user bio on profile save to prevent XSS
  • Removed insecure editor/* permission for editor role
  • Sanitized theme name to prevent potential injection
  • Fixed validateUrl to avoid IP redirects to private networks
  • Added field templates

New Features

  • Sanitized user bio
  • Sanitized theme name
  • Field templates
  • Improved sanitizeHTML to prevent more XSS variants

Full Release Notes

* Sanitize save global file, removed editor/* permission for editor role, reported by @m1n9yu3 https://github.com/givanz/Vvveb/commit/c8fef41ad8651d348050c513451755ab8882b97e
* Sanitize theme name, reported by @geo-chen https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746
* Added sanitize to user bio on profile save, fixed sanitizeHTML to prevent more XSS variants, reported by @JosanGeorge https://github.com/givanz/Vvveb/commit/20a01ef08559ffdc97205edeecde86c8ea27e567
* Check host ip address for validateUrl to avoid ip redirects to private network, reported by @elvinsuleymanov https://github.com/givanz/Vvveb/commit/bd280f5ce136f6da22c873fb1eea9cad8741e623 
* Field templates https://github.com/givanz/Vvveb/commit/57a342b8c96872e084fef7931783243dc74438b1