Post

SkyFeed Classic
@skyfeed.app

Hey SkyFeed users, please make sure your app is on version v0.8.3 or later (written in the top left). This release fixes a security vulnerability which could lead to someone stealing your session if they tricked you into clicking a maliciously crafted link. Not exploited in the wild yet afaik!

SkyFeed Classic
@skyfeed.app

I was very surprised to learn that pub.dev/packages/url... just happily executes JavaScript code if you pass it to the `launchUrl` method, that's not a URL :( should be disabled by default

1 repost9 likes

redsolver
@redsolver.dev

I could not find a bug report after a quick search in the flutter packages repo, so just tested if it still works in the latest url_launcher example app (yes) and sent a more detailed description of the bug to security@flutter.dev

SkyFeed Classic
@skyfeed.app

oh yeah also the "fix" actually just disables links completely for now, until I had time to dive into what black magic the url_launcher lib is actually doing under the hood