⚠️ Security update
Version 1.0.0 (and the ianm/synopsis
package before it) contains an HTML injection vulnerability in the plain content mode. You should update immediately.
A second issue with the rich content HTML truncation could also lead to security issues, though I have not been able to create an exploit for it.
If you cannot update immediately, you should disable the extension.
These problems were discovered through internal code review.
Version 1.0.1
- Fix HTML injection in plain content mode
- Implement proper HTML truncating in rich content mode
If you use rich content mode, the excerpt length now counts the number of printed characters and ignores the length of invisible HTML tags and attributes. This means the excerpt will probably be longer than before and actually reflect the value of the setting.
For extension developers, the signature of the javascript component Excerpt::getContent()
had to be changed. It must now return a plain text or Vnode, and is no longer parsed as HTML. If you were returning an HTML string, the HTML will now be printed as text and no longer injected as HTML.