You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Bug FixesKind: in v2.1.265,
Bug FixesSection of the release
What
A URL-handling function that previously accepted any http or https URL now rejects URLs that embed a username or password, such as user:pass@host. Instead of processing the URL, it returns nothing.
Why
URLs with embedded credentials can leak sensitive information or be used to disguise the real destination of a link. Rejecting them closes off that risk.
