Skip to content

Release 3.5.0 - #236

Merged
onizet merged 11 commits into
masterfrom
dev
Jul 20, 2026
Merged

Release 3.5.0#236
onizet merged 11 commits into
masterfrom
dev

Prevent script injection from input

ed018b2
Select commit
Loading
Failed to load commit list.
SonarQubeCloud / SonarCloud Code Analysis succeeded Jul 20, 2026 in 10s

Annotations

Check failure on line 174 in src/Html2OpenXml/Collections/HtmlAttributeCollection.cs

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

Refactor this method to reduce its Cognitive Complexity from 16 to the 15 allowed.

See more on https://sonarcloud.io/project/issues?id=onizet_html2openxml&issues=AZ-BdJ1zPDIr-DRZvh6y&open=AZ-BdJ1zPDIr-DRZvh6y&pullRequest=236

Check failure on line 79 in .github/workflows/publish_nuget.yml

See this annotation in the file changed.

@sonarqubecloud sonarqubecloud / SonarCloud Code Analysis

inputs.version is vulnerable to script injection: values of inputs are provided by whoever triggers the workflow. Change this workflow to not use user-controlled data directly in a run block, for example by assigning this expression to an environment variable.

See more on https://sonarcloud.io/project/issues?id=onizet_html2openxml&issues=AZ-BdJ7qPDIr-DRZvh6z&open=AZ-BdJ7qPDIr-DRZvh6z&pullRequest=236