hanzoai/esbuild
2
0
Fork 0
mirror of https://github.com/hanzoai/esbuild.git synced 2026-09-24 16:58:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix \ in markdown release notes

Browse Source
This commit is contained in:
Evan Wallace
2026-06-11 21:32:29 -04:00
parent 98d342b426
commit 1eab79ab86
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+2 -2
View File
@@ -2,9 +2,9 @@
## 0.28.1
* Disallow `\\` in local development server HTTP requests ([GHSA-g7r4-m6w7-qqqr](https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr))
* Disallow ``\`` in local development server HTTP requests ([GHSA-g7r4-m6w7-qqqr](https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr))
This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a `\\` backslash character. It happened due to the use of Go's `path.Clean()` function, which only handles Unix-style `/` characters. HTTP requests with paths containing `\\` are no longer allowed.
This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a ``\`` backslash character. It happened due to the use of Go's `path.Clean()` function, which only handles Unix-style `/` characters. HTTP requests with paths containing ``\`` are no longer allowed.
Thanks to [@dellalibera](https://github.com/dellalibera) for reporting this issue.