The um-block-emails extensions uses a domain list from an external repository. While it is already a potential risk to import an external list, I'd highly suggest to import it from github direcly instead of a third party service to prevent any thrid-party modification as we've seen with the polyfill.io attack (and more in the past).
Therefore I suggest to replace the URL with the raw GH-URL:
|
/** |
|
* CDN API URL |
|
*/ |
|
const API_URL = 'https://rawcdn.githack.com/disposable/disposable-email-domains/master/domains.json'; |
The
um-block-emailsextensions uses a domain list from an external repository. While it is already a potential risk to import an external list, I'd highly suggest to import it from github direcly instead of a third party service to prevent any thrid-party modification as we've seen with the polyfill.io attack (and more in the past).Therefore I suggest to replace the URL with the raw GH-URL:
Extended/src/um-block-emails/src/Core.php
Lines 17 to 20 in d075928