Skip to content

Standalone #9189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
eliandoran wants to merge 620 commits into
base: main
Choose a base branch
from

Merge remote-tracking branch 'origin/main' into standalone

9b91ba5
Select commit
Loading
Failed to load commit list.
Draft

Standalone #9189

Merge remote-tracking branch 'origin/main' into standalone
9b91ba5
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL failed Apr 26, 2026 in 4s

16 new alerts including 13 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 13 high
  • 3 medium

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 57 in .github/workflows/mobile.yml

See this annotation in the file changed.

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Check failure on line 40 in packages/trilium-core/src/services/attribute_formatter.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Check failure on line 94 in packages/trilium-core/src/services/export/markdown.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Check failure on line 99 in packages/trilium-core/src/services/export/markdown.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Check failure on line 194 in packages/trilium-core/src/services/export/markdown.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Check failure on line 196 in packages/trilium-core/src/services/export/markdown.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Check failure on line 660 in packages/trilium-core/src/services/notes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<img' and with many repetitions of '<img'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<img' and with many repetitions of '<img'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<img' and with many repetitions of '<img'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<img' and with many repetitions of '<img'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<img' and with many repetitions of '<img'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<img' and with many repetitions of '<img'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<img' and with many repetitions of '<img'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<img' and with many repetitions of '<img'.

Check failure on line 675 in packages/trilium-core/src/services/notes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with 'api/attachments/' and with many repetitions of 'api/attachments/'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with 'api/attachments/' and with many repetitions of 'api/attachments/'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with 'api/attachments/' and with many repetitions of 'api/attachments/'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with 'api/attachments/' and with many repetitions of 'api/attachments/'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with 'api/attachments/' and with many repetitions of 'api/attachments/'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with 'api/attachments/' and with many repetitions of 'api/attachments/'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with 'api/attachments/' and with many repetitions of 'api/attachments/'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with 'api/attachments/' and with many repetitions of 'api/attachments/'.

Check failure on line 763 in packages/trilium-core/src/services/notes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a' and with many repetitions of '<a'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!"' and with many repetitions of '\thref="data:!;base64,!"'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!">' and with many repetitions of '<a\thref="data:!;base64,!">a'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a' and with many repetitions of '<a'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!"' and with many repetitions of '\thref="data:!;base64,!"'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!">' and with many repetitions of '<a\thref="data:!;base64,!">a'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a' and with many repetitions of '<a'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!"' and with many repetitions of '\thref="data:!;base64,!"'.
This
regular expression
Loading
that depends on
a user-provided value
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!">' and with many repetitions of '<a\thref="data:!;base64,!">a'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a' and with many repetitions of '<a'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!"' and with many repetitions of '\thref="data:!;base64,!"'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!">' and with many repetitions of '<a\thref="data:!;base64,!">a'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a' and with many repetitions of '<a'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!"' and with many repetitions of '\thref="data:!;base64,!"'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!">' and with many repetitions of '<a\thref="data:!;base64,!">a'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a' and with many repetitions of '<a'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!"' and with many repetitions of '\thref="data:!;base64,!"'.
This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<a\thref="data:!;base64,!">' and with many repetitions of '<a\thref="data:!;base64,!">a'.

Check failure on line 159 in packages/trilium-core/src/services/utils/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
on
Loading
, which may cause an HTML attribute injection vulnerability.

Check failure on line 158 in packages/trilium-core/src/services/utils/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
on
Loading
, which may cause an HTML attribute injection vulnerability.

Check failure on line 156 in packages/trilium-core/src/services/utils/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
<script
Loading
, which may cause an HTML element injection vulnerability.

Check failure on line 156 in packages/trilium-core/src/services/utils/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Bad HTML filtering regexp High

This regular expression does not match script end tags like </script >.

Check failure on line 378 in packages/trilium-core/src/services/utils/index.ts

See this annotation in the file changed.

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
<script
Loading
, which may cause an HTML element injection vulnerability.

Check warning on line 142 in packages/trilium-core/src/routes/api/branches.ts

See this annotation in the file changed.

Code scanning / CodeQL

Prototype-polluting assignment Medium

This assignment may alter Object.prototype if a malicious '__proto__' string is injected from
user controlled input
Loading
.

Check warning on line 392 in packages/trilium-core/src/services/notes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Prototype-polluting assignment Medium

This assignment may alter Object.prototype if a malicious '__proto__' string is injected from
user controlled input
Loading
.