github-featured / nextlevelbuilder--ui-ux-pro-max-skill

发布

0 发布 49 Git 标签

RSS 订阅源
  • v2.6.1 9bb646b336
    比较

    fix: validate plugin names in tailwind config generator to prevent code injection (#275)

    frostbyte_neo 发布于 2026-06-22 17:34:41 +00:00 | 105 次提交 在此版本后已推送到 main

    The _format_plugins() method interpolated plugin names directly into
    require() statements without sanitization. A plugin name containing
    a single quote could break out of require() and inject arbitrary
    JavaScript that executes when Node.js loads the generated config.

    Add a strict regex allowlist matching valid npm package name patterns
    (optional @scope, alphanumeric/hyphen/underscore, optional subpath).
    Reject any plugin name that doesn't match before generating output.

    Closes #246

    下载附件