Drupal

"Anemone": The brief tale of a Drupal core security advisory

xjm — Sat, 28 Jun 2025 20:03:10 +0000

"Anemone": The brief tale of a Drupal core security advisory xjm Sat, 06/28/2025 - 15:03

A long while back, security researcher Sam Mortenson reported a cross-site scripting vulnerability in Drupal core's Link module. Essentially, the options property on link fields was not being properly sanitized. This meant cross-site scripting was possible under some circumstances -- and, as always for cross-site scripting, we were concerned that the XSS could be combined with other attacks and escalated to more serious exploits.

New core committer sponsors: HeroDevs, Salsa Digital, and... maybe you?

xjm — Fri, 13 Oct 2023 21:43:15 +0000

New core committer sponsors: HeroDevs, Salsa Digital, and... maybe you? xjm Fri, 10/13/2023 - 16:43

Great news: After a three-month search, I'm now contracting with two sponsors who are funding a total of 60% of my time for Drupal core release management. Let me introduce you!

Why sponsor a core committer?

xjm — Thu, 22 Dec 2022 01:40:05 +0000

Why sponsor a core committer? xjm Wed, 12/21/2022 - 19:40

This post was collaboratively authored with other Drupal core committers including quietone, pameeela, catch, effulgentsia, larowlan, lauriii, and Dries.

Fund xjm as a Drupal core release manager

xjm — Mon, 05 Dec 2022 18:44:09 +0000

Fund xjm as a Drupal core release manager xjm Mon, 12/05/2022 - 12:44

Hi, I'm xjm. I'm a Drupal core committer, one of eighteen people who are trusted to accept (merge) code changes to the Drupal project for the hundreds of thousands of sites that rely on it.

My role on the committer team is that of a release manager. We're the folks who actually create the Drupal core releases that you can install on your site.

Security, Drupal 9, and Navigating the Changing Web Landscape (DrupalSouth 2019 keynote)

xjm — Mon, 23 Dec 2019 01:28:42 +0000

Security, Drupal 9, and Navigating the Changing Web Landscape (DrupalSouth 2019 keynote) xjm Sun, 12/22/2019 - 19:28

Back in 2013, I led the core contribution mentoring day at DrupalCon Sydney. I'd already flown from the US to Europe three times at that point (first for Drupal Developer Days Barcelona, then for DrupalCon Munich and the Paris VDC sprint, and finally for a whirlwind 72 hours in London to sprint on VDC and CMI). None of that prior international travel prepared me in the slightest for the over 24 hours of nonstop air travel/physical torture that it takes to get from Wisconsin to Australia.