Oneric 11ae8344eb Sanitise Content-Type of media proxy URLs ... Just as with uploads and emoji before, this can otherwise be used to place counterfeit AP objects or other malicious payloads. In this case, even if we never assign a priviliged type to content, the remote server can and until now we just mimcked whatever it told us. Preview URLs already handle only specific, safe content types and redirect to the external host for all else; thus no additional sanitisiation is needed for them. Non-previews are all delegated to the modified ReverseProxy module. It already has consolidated logic for building response headers making it easy to slip in sanitisation. Although proxy urls are prefixed by a MAC built from a server secret, attackers can still achieve a perfect id match when they are able to change the contents of the pointed to URL. After sending an posts containing an attachment at a controlled destination, the proxy URL can be read back and inserted into the payload. After injection of counterfeits in the target server the content can again be changed to something innocuous lessening chance of detection.		2024-03-18 22:33:10 -01:00
..
activity	Prune old Update activities	2024-02-17 16:57:40 +01:00
akkoma	Add MRFs for direct message manipulation	2023-05-22 23:53:44 +01:00
captcha
collections	Add URL and code to :not_found errors	2022-12-09 20:13:31 +00:00
config	Config: Check the permissions of the linked file instead of the symlink↵	2024-02-14 18:30:27 +01:00
conversation
docs	backend-i18n (#121)	2022-07-27 21:56:59 +00:00
ecto_type
emails	Provide sane defaults for SMTP	2024-02-12 22:45:57 +01:00
emoji	Merge branch 'elixir1.15' into develop	2023-08-04 15:16:14 +01:00
helpers	giant massive dep upgrade and dialyxir-found error emporium (#371)	2022-12-14 12:38:48 +00:00
http	Support elixir1.15	2023-08-03 17:44:09 +01:00
instances	Add timeline visibility options	2023-03-17 15:33:28 +00:00
mfa
migration_helper	purge chat and shout endpoints	2022-07-21 11:29:28 +01:00
migrators	Support elixir1.15	2023-08-03 17:44:09 +01:00
object	Tag Mock-tests as "mocked" and run them seperately	2023-08-04 12:50:50 +01:00
password
reverse_proxy	giant massive dep upgrade and dialyxir-found error emporium (#371)	2022-12-14 12:38:48 +00:00
search	giant massive dep upgrade and dialyxir-found error emporium (#371)	2022-12-14 12:38:48 +00:00
tests
upload	Support elixir1.15	2023-08-03 17:44:09 +01:00
uploaders	Use finch everywhere (#33)	2022-07-04 16:30:38 +00:00
user	Support elixir1.15	2023-08-03 17:44:09 +01:00
web	Fix Content-Type of our schema	2024-03-18 22:33:10 -01:00
workers	Prune old Update activities	2024-02-17 16:57:40 +01:00
activity.ex	Support elixir1.15	2023-08-03 17:44:09 +01:00
announcement.ex	giant massive dep upgrade and dialyxir-found error emporium (#371)	2022-12-14 12:38:48 +00:00
announcement_read_relationship.ex	Merge branch 'from/upstream-develop/tusooa/server-announcements' into 'develop' (#85)	2022-07-18 13:08:36 +00:00
application.ex	Ensure we can't crash out on unusual logger backend settings	2023-08-06 15:12:57 +01:00
application_requirements.ex	Support elixir1.15	2023-08-03 17:44:09 +01:00
bookmark.ex
caching.ex
captcha.ex
clippy.ex
config.ex
config_db.ex	Do not crash on invalid atom in configDB	2022-12-21 00:16:39 +00:00
constants.ex	fix the /embed endpoint	2023-05-31 23:42:08 +00:00
conversation.ex
counter_cache.ex
data_migration.ex
delivery.ex
ecto_enums.ex	v2 Suggestions: dismiss a suggestion	2021-11-26 20:19:29 -06:00
emoji-test.txt	emoji-test: update to latest 15.0 draft	2022-09-11 19:55:45 +01:00
emoji.ex	Remove _misskey_reaction matching (#500)	2023-03-10 18:46:49 +00:00
filter.ex
following_relationship.ex	paginate follow requests (#460)	2023-02-04 20:51:17 +00:00
formatter.ex	Interpret \n as newline for MFM	2023-02-18 19:56:11 +01:00
frontend.ex	Ensure Gun is Gone	2022-12-11 19:26:21 +00:00
hashtag.ex	Remerge of hashtag following (#341)	2022-12-05 12:58:48 +00:00
healthcheck.ex
html.ex
http.ex	Allow Pleroma.HTTP to connect to raw-HTTP without freaking mint out	2023-08-04 23:51:15 +01:00
instances.ex	Add Signed Fetch Statistics (#312)	2022-11-26 19:22:56 +00:00
iso639.ex	Add language support on /api/v1/statuses	2023-01-10 10:29:17 +00:00
job_queue_monitor.ex	Use fully qualified function capture for telementry event	2024-02-12 01:59:18 +01:00
jwt.ex
keys.ex
list.ex
logging.ex
maintenance.ex	Support elixir1.15	2023-08-03 17:44:09 +01:00
maps.ex
marker.ex
mfa.ex
moderation_log.ex	giant massive dep upgrade and dialyxir-found error emporium (#371)	2022-12-14 12:38:48 +00:00
notification.ex	Require related object for notifications to filter on content	2023-06-14 19:41:48 +00:00
object.ex	giant massive dep upgrade and dialyxir-found error emporium (#371)	2022-12-14 12:38:48 +00:00
object_tombstone.ex
otp_version.ex
pagination.ex	Add /api/v1/followed_tags	2022-12-31 18:09:34 +00:00
password.ex	update references to pleroma in docs	2022-12-30 03:43:35 +00:00
password_reset_token.ex
prometheus_exporter.ex	Use a genserver to periodically fetch metrics	2023-01-01 18:32:14 +00:00
registration.ex
release_tasks.ex	giant massive dep upgrade and dialyxir-found error emporium (#371)	2022-12-14 12:38:48 +00:00
repo.ex	Remove instrumentors (#98)	2022-07-21 11:32:17 +00:00
report_note.ex
reverse_proxy.ex	Sanitise Content-Type of media proxy URLs	2024-03-18 22:33:10 -01:00
scheduled_activity.ex
search.ex	Don't try removing deleted users and such from index as posts	2022-06-29 20:49:45 +01:00
signature.ex	Fix invalid Date HTTP header when signing fetch requests	2023-08-07 12:43:42 +00:00
stats.ex	update stats every 5 minutes	2022-12-16 17:22:56 +00:00
thread_mute.ex
upload.ex	Always insert Dedupe upload filter	2024-03-18 22:33:10 -01:00
user.ex	Federate user profile background	2024-02-16 16:35:51 +01:00
user_invite_token.ex
user_note.ex	Make UserNote comment default to the empty string.	2023-04-27 05:22:12 +00:00
user_relationship.ex	fix flaky test_user_relationship_test.exs:81	2022-10-23 13:31:01 +02:00
utils.ex	extend custom runtime system (#108)	2022-07-24 16:42:43 +00:00
web.ex	Migrate to phoenix 1.7 (#626)	2023-08-15 10:22:18 +00:00
xml_builder.ex