Skip to content

Commit

Permalink
Release 2.0.0 (#76)
Browse files Browse the repository at this point in the history
  • Loading branch information
weizman authored Jul 18, 2023
1 parent 0df0c28 commit ce83478
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ to **non extension javascript with the same privileges as the web app**.
## 🚨 IMPORTANT UPDATE 🚨

Starting Version [1.6.0](https://github.com/LavaMoat/snow/pull/76) Snow officially doesn't support vulnerabilities that
Starting Version [2.0.0](https://github.com/LavaMoat/snow/pull/76) Snow officially doesn't support vulnerabilities that
can be protected against by disallowing `unsafe-inline` completely and by correctly using the `object-src` directive to not allow `self`.

To learn more why is that, see [section 3](#install).
Expand Down Expand Up @@ -109,7 +109,7 @@ in order for it to play its role securely.
the modified version might contain flaws that attackers might use to cancel its effect (for further
explanation see [natives](https://github.com/lavamoat/snow/wiki/Introducing-Snow#natives) section).

3. **Most importantly, it's highly vulnerable without minimal help from CSP** - As of version 1.6.0 the project will
3. **Most importantly, it's highly vulnerable without minimal help from CSP** - As of version 2.0.0 the project will
seize to attempt to defend against vulnerabilities that aren't possible to exploit when
(a) `unsafe-inline` isn't allowed and (b) `object-src` to `self` isn't allowed.
This is because (a) defending against string-JS attacks is basically an endless task and probably impossible, and
Expand Down
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@lavamoat/snow",
"version": "1.5.0",
"version": "2.0.0",
"description": "standardize how to recursively own newborn windows within a web app, from the context of the app itself",
"main": "src/index.js",
"devDependencies": {
Expand Down

0 comments on commit ce83478

Please sign in to comment.