
Security News
Free Certified Patch for Critical Rails Active Storage Vulnerability
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.
The purpose is to allow URLs to point to any text piece in a document:
To both interpret and create the URLs, the module works bidirectionally:
To see things in action, check out this [quote in the example document](https://rawgit.com/Treora/quoteurl/master/example.html#"libero egestas"); then try select some other words to get a new URL.
To make a page support quote-URLs, simply include dist/quoteurl.js (or dist/quoteurl.min.js) in that page: <script src="dist/quoteurl.js"></script>.
When using tools like Browserify, require('quoteurl'); should work. You can get the module from NPM's repository: npm install quoteurl.
Although currently very little extension or customisation is possible, the appearance of the highlighted text can be customised by styling the CSS class highlighted-by-url (use !important to override the property background-color).
This implementation is a proof of concept, and is not reliable for production use. It usually messes up when the quoted text appears multiple times.
Moreover, a simple syntax of fragment identifiers has been chosen tentatively. This encoding may change in future versions, which would thus break with URLs created with this version; which leads us to the next point.
This script only enables creating links to quotes within the page that incorporates the script. Ideally, this functionality would of course be available for any page.
A great step forward would be the standardisation of fragment identifiers that point to arbitrary pieces of an HTML document. Currently, fragment identifiers are only used to point to places in the document that have been given an identifier by the document's publisher (e.g. <a name="section4" />). We lack the ability to analyse a document and refer to any piece of it. Other hypertext systems (e.g Ted Nelson's proposals) included such functionality, and currently the work on Open Annotation Selectors attempts to standardise ways to refer to pieces of content, using JSON objects. A sensible way to build on top of this effort is to specify an encoding of OA Selectors in fragment identifiers (see oa-selector-in-url.js).
Standardisation would be a step towards browser integration, so that referring to quotes will work on any document. An implementation like this quoteurl could then be regarded merely as a shim to provide the functionality in backward browsers.
FAQs
Allow URLs to point to any text piece in a document.
We found that quoteurl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.

Security News
/Threat Research
A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when a stolen GitHub token is revoked.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.