aa2b8c43f1
Task titles, UIDs, descriptions, categories, organizer usernames, alarm descriptions, relation UIDs, and the calendar name were concatenated raw into the VCALENDAR text. A task title containing CR/LF could plant new iCalendar properties (ATTACH, X-INJECTED, VALARM, etc.) that CalDAV clients would parse as legitimate calendar data. Introduce escapeICalText, which escapes backslash, CR/LF, semicolon, and comma per RFC 5545 §3.3.11, and apply it at every sink in ParseTodos, ParseAlarms, and ParseRelations. Each Category is escaped individually; the comma that joins categories is the literal list delimiter and stays unescaped. The now-redundant regexp-based LF handling in the DESCRIPTION branch is removed. getCaldavColor is hardened at the same output boundary: non-hex characters are stripped before interpolation so CR/LF in a crafted color string cannot inject new iCal property lines, closing a gap where upstream HexColor validation only bounds length and does not reject control characters. Fixes GHSA-2g7h-7rqr-9p4r. |
||
|---|---|---|
| .claude | ||
| .github | ||
| .vscode | ||
| .zed | ||
| build | ||
| contrib | ||
| desktop | ||
| examples/plugins/example | ||
| frontend | ||
| pkg | ||
| rest | ||
| .devcontainer.json | ||
| .dockerignore | ||
| .editorconfig | ||
| .envrc | ||
| .gitignore | ||
| .golangci.yml | ||
| .opensourcefinder-verify | ||
| AGENTS.md | ||
| CHANGELOG.md | ||
| CLAUDE.md | ||
| CONTRIBUTING.md | ||
| CRUSH.md | ||
| Dockerfile | ||
| LICENSE | ||
| README.md | ||
| cliff.toml | ||
| code-header-template.txt | ||
| conductor.json | ||
| config-raw.json | ||
| crowdin.yml | ||
| devenv.lock | ||
| devenv.nix | ||
| devenv.yaml | ||
| go.mod | ||
| go.sum | ||
| magefile.go | ||
| main.go | ||
| nfpm.yaml | ||
| publiccode.yml | ||
| renovate.json | ||
| tsconfig.json | ||
| vikunja.initd | ||
| vikunja.service | ||
README.md
Vikunja
The Todo-app to organize your life.
If Vikunja is useful to you, please consider buying me a coffee, sponsoring me on GitHub or buying a sticker pack. I'm also offering a hosted version of Vikunja if you want a hassle-free solution for yourself or your team.
Table of contents
Security Reports
If you find any security-related issues you don't want to disclose publicly, please use the contact information on our website.
Features
See the features page on our website for a more exhaustive list or try it on try.vikunja.io!
Docs
All docs can be found on the Vikunja home page.
Roadmap
See the roadmap (hosted on Vikunja!) for more!
Contributing
Please check out the contribution guidelines on the website.
License
Most of this repository is licensed under AGPL‑3.0‑or‑later.
The contents of desktop/ are licensed under
GPL‑3.0‑or‑later.
Unsplash Images
Background images from Unsplash are distributed under the Unsplash License. The license requires giving credit to the photographer and Unsplash. See Unsplash’s terms for more information.