Install
Works with Drupal: ^11.4 || ^12Using Composer to manage Drupal site dependencies
Alternative installation files
Download tar.gz
42.69 KB
MD5: 5c7f9cf6b95eb3e883b89ccb8acf11f0
SHA-1: cbe82639e6dbb4c7fac2ec900c063d7a39cacde4
SHA-256: 473186407515329c445e683dc0304b7659400206062dd22fe976b198009e879b
Download zip
68.78 KB
MD5: 4c60d67a4170805d98169f0b9ac38353
SHA-1: d946e5df8d99facc599f39c1893daa2defdfa247
SHA-256: 58e825bc107391027264558e15f72adb362d35c1386746c969c13f1d31636f5a
Release notes
This release fixes a stored cross-site scripting issue in the UI Interaction components that could let a user with Canvas editing access run JavaScript in other users' browsers, and adds a composer.json
Bug fixes
- animated_sdc#1: Dangerous URL schemes: The url prop was output directly into href, so a stored javascript value executed when a visitor clicked the item.
The prop is now validated as a URI reference and additionally passed through the safe_url filter at render. - UI Interaction Button hover — same validation added. hover_url already passed through safe_url at render; it now also carries the http/https scheme allowlist so disallowed schemes are rejected when the component is saved.
- Added composer.json (type: drupal-module) declaring drupal/canvas: ^1 and drupal/gsap: ^1, with drush/drush under require-dev.
- Clarified the safe_url Twig filter docblock (it returns an unescaped string; escaping is Twig's responsibility).
Notes
Minimum core raised to Drupal 11.4: the Heading component uses core's html_cva Twig function, added in Drupal 11.4.
Contributors
@jamestarleton, @vishalkadam and @aftrix — feedback and review
Bug fixes
