Headline

CVE-2022-21158: Release 0.17.0 · marktext/marktext

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: scheme) inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext.

2 years ago

CVE

Open in Source

#xss #vulnerability #mac #windows #git #java

Releases
v0.17.0

0.17.0

Mark Text is now MarkText! We’d like to thank all contributors and users that have been using MarkText and worked on this release.

⚠️Breaking Changes:

Changed multiple default key bindings.
Changed key binding handling: all key bindings are now mapped to the corresponding US key bindings. E.g. Ctrl+Shift+7 on a German keyboard will now produce Ctrl+/ because Shift+7 is equivalent to /.
Image uploader: SM.MS was removed, GitHub uploader is deprecated and will be replaced by PicGo in our next release.

🌵Feature

Added support for image path variables.
Added command-line image uploader and reworked settings.
Added regular expression group replacement to searcher.
Added PlantUML diagram support.
Added support for chemical equations in math mode.
Added automatic call to search for find-in-file when the pane is opened.
Open local non-markdown files in default application.
Added support to use all menu entries for key binding.
Added window zoom via default mouse event.
Zoom level is now restored on startup.
Added PicGo to upload images.
Ability to invalidate image cache on demand.
Added settings page to configure key bindings.

🦋Optimization

Improved inline markdown autocomplete support.
Improved preference design.
Relative image paths are now converted to forward slashes on Windows for better compatibility.
Center sidebar image when no search results are available.
Updated emoji database.
Improved sidebar file handling UX by providing more error messages.

🪲Bug fix

Fixed an issue with code block cursor positioning.
Fixed invalid mermaid diagram representation when exporting as PDF.
Fixed rendering issue with LaTeX formulas
Fixed an issue that may caused editor flickering while pressing Enter.
Fixed Table of Contents sidebar display issue.
Fixed editor overflow when the sidbar is open.
Fixed a crash that occurred due to a bug in the markdown footnote parser.
Fixed issue with shortcuts that included Alt.
Fixed multiple issues on non-US keyboards.
Normalized source-code editor cursor.
Fixed preference scaling issue and added missing scrollbar.
Fixed a rendering issue when multiple elements were selected via keyboard.
Fixed preference migrations were always executed on start-up.
Fixed scrolling and search match positing with high DPI scaling.
Fixed slow startup on Windows due to a blocking call.
Fixed an issue that caused the paste handler to insert only HTML content if HTML rendering was disabled.
Fixed file rename with editor dialog.
Fixed URL open handler when clicking a link in the editor.
Fixed an issue that prevented to unindent a list item.
Fixed multiple XSS issues on language selector and data input.
Fixed a bug that HTML was rendered in preview mode even it was disabled in settings.
HTML character encoding is now supported in code blocks.