hanzoai/DOMPurify
2
0
Fork 0
mirror of https://github.com/hanzoai/DOMPurify.git synced 2026-09-24 16:55:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix links in SECURITY.md for threat model and attack class (#1483)

Browse Source 
Updated links in the SECURITY.md document to point to the relevant wiki pages.
This commit is contained in:
Cure53
2026-06-13 18:27:53 +02:00
committed by GitHub
parent ae9f24044c
commit c1815ac6e2
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+2 -2
View File
@@ -31,8 +31,8 @@ The dividing line is about *who supplies the dangerous element*, not how severe
the consequence sounds. A report framed as "stored XSS" that requires the
application to allow `onerror` via a hook is still a hardening bug, because the
application allowed `onerror`. Configuration patterns that are safe by default
but become dangerous when enabled are documented in the wiki's threat-model and
attack-class pages.
but become dangerous when enabled are documented in the wiki's [threat-model](https://github.com/cure53/DOMPurify/wiki/Security-Goals-&-Threat-Model) and
[attack-class](https://github.com/cure53/DOMPurify/wiki/Attack-Classes-&-Bypass-History) pages.
## Supply Chain Security