sections_fts: 47
This data as json
| rowid | title | content |
|---|---|---|
| 47 | Security fixes | Fixed an identifier-quoting bug in datasette.utils.escape_sqlite() . Datasette uses this helper when constructing SQL around table and column names; identifiers containing ] could break out of SQLite bracket quoting and alter the generated SQL, for example by adding a UNION SELECT . Identifiers containing ] are now quoted using double quotes instead. ( #2677 ) Fixed an open redirect vulnerability. Requesting a path such as /\example.com/ produced a redirect with a Location: /\example.com header - browsers normalize backslashes to forward slashes, turning that into the protocol-relative URL //example.com and redirecting the user off-site. Any run of leading slashes and backslashes in a redirect path is now collapsed to a single slash. ( #2680 ) |