search

babluboy / bookworm

A simple ebook reader for Elementary OS
GNU General Public License v3.0
1.32k stars 101 forks source link

Fix some vulnerability issues (mentioned in #283) #347

Closed shiraeeshi closed 3 years ago

shiraeeshi commented 3 years ago

This PR adds Content-Security-Policy (csp) meta tag to the page (see the discussion in #283).

This tag takes care of most of security issues (except submitting a form) exemplified in epub-test.

TODO: do something about the set_allow_universal_access_from_file_urls setting in window.vala

I tried disabling it, but links to footnotes don't work without it.

babluboy commented 3 years ago

Hi - can you please do a PR on dev. Master is the stable branch. once i commit on dev we can do some testing and bundled with other stuff sync with master and release

babluboy commented 3 years ago

I have updated the dev branch with your PR - will check the dev branch soon and bundle with other changes into master when ready for release. If you have any more PRs please raise PRs against the dev branch

shiraeeshi commented 3 years ago

Good. As to other PRs: what do you think about adding plugins functionality to bookworm? I'm thinking about how to make it general enough. A plugin is something like a js-file that can talk to sh-file, and also settings config. Is it ok to allow to add sh files from the security point of view?