itepechi/akkoma
1
0
Fork 0
Code Issues Pull requests Releases Activity
akkoma/lib/pleroma
History
Oneric 11ae8344eb Sanitise Content-Type of media proxy URLs 
Just as with uploads and emoji before, this can otherwise be used
to place counterfeit AP objects or other malicious payloads.
In this case, even if we never assign a priviliged type to content,
the remote server can and until now we just mimcked whatever it told us.

Preview URLs already handle only specific, safe content types
and redirect to the external host for all else; thus no additional
sanitisiation is needed for them.

Non-previews are all delegated to the modified ReverseProxy module.
It already has consolidated logic for building response headers
making it easy to slip in sanitisation.

Although proxy urls are prefixed by a MAC built from a server secret,
attackers can still achieve a perfect id match when they are able to
change the contents of the pointed to URL. After sending an posts
containing an attachment at a controlled destination, the proxy URL can
be read back and inserted into the payload. After injection of
counterfeits in the target server the content can again be changed
to something innocuous lessening chance of detection.
2024-03-18 22:33:10 -01:00
..
activity Prune old Update activities 2024-02-17 16:57:40 +01:00
akkoma Add MRFs for direct message manipulation 2023-05-22 23:53:44 +01:00
captcha
collections Add URL and code to :not_found errors 2022-12-09 20:13:31 +00:00
config Config: Check the permissions of the linked file instead of the symlink↵ 2024-02-14 18:30:27 +01:00
conversation
docs backend-i18n (#121) 2022-07-27 21:56:59 +00:00
ecto_type
emails Provide sane defaults for SMTP 2024-02-12 22:45:57 +01:00
emoji Merge branch 'elixir1.15' into develop 2023-08-04 15:16:14 +01:00
helpers giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
http Support elixir1.15 2023-08-03 17:44:09 +01:00
instances Add timeline visibility options 2023-03-17 15:33:28 +00:00
mfa
migration_helper purge chat and shout endpoints 2022-07-21 11:29:28 +01:00
migrators Support elixir1.15 2023-08-03 17:44:09 +01:00
object Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
password
reverse_proxy giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
search giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
tests Fix compile cycle in Pleroma.Tests.AuthTestController 2021-06-09 13:30:19 -05:00
upload Support elixir1.15 2023-08-03 17:44:09 +01:00
uploaders Use finch everywhere (#33) 2022-07-04 16:30:38 +00:00
user Support elixir1.15 2023-08-03 17:44:09 +01:00
web Fix Content-Type of our schema 2024-03-18 22:33:10 -01:00
workers Prune old Update activities 2024-02-17 16:57:40 +01:00
activity.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
announcement.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
announcement_read_relationship.ex Merge branch 'from/upstream-develop/tusooa/server-announcements' into 'develop' (#85) 2022-07-18 13:08:36 +00:00
application.ex Ensure we can't crash out on unusual logger backend settings 2023-08-06 15:12:57 +01:00
application_requirements.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
bookmark.ex
caching.ex
captcha.ex
clippy.ex
config.ex
config_db.ex Do not crash on invalid atom in configDB 2022-12-21 00:16:39 +00:00
constants.ex fix the /embed endpoint 2023-05-31 23:42:08 +00:00
conversation.ex
counter_cache.ex
data_migration.ex
delivery.ex
ecto_enums.ex v2 Suggestions: dismiss a suggestion 2021-11-26 20:19:29 -06:00
emoji-test.txt emoji-test: update to latest 15.0 draft 2022-09-11 19:55:45 +01:00
emoji.ex Remove _misskey_reaction matching (#500) 2023-03-10 18:46:49 +00:00
filter.ex
following_relationship.ex paginate follow requests (#460) 2023-02-04 20:51:17 +00:00
formatter.ex Interpret \n as newline for MFM 2023-02-18 19:56:11 +01:00
frontend.ex Ensure Gun is Gone 2022-12-11 19:26:21 +00:00
hashtag.ex Remerge of hashtag following (#341) 2022-12-05 12:58:48 +00:00
healthcheck.ex
html.ex Break out activity-specific HTML functions into Pleroma.Activity.HTML 2021-05-29 12:29:11 -05:00
http.ex Allow Pleroma.HTTP to connect to raw-HTTP without freaking mint out 2023-08-04 23:51:15 +01:00
instances.ex Add Signed Fetch Statistics (#312) 2022-11-26 19:22:56 +00:00
iso639.ex Add language support on /api/v1/statuses 2023-01-10 10:29:17 +00:00
job_queue_monitor.ex Use fully qualified function capture for telementry event 2024-02-12 01:59:18 +01:00
jwt.ex
keys.ex
list.ex
logging.ex
maintenance.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
maps.ex
marker.ex
mfa.ex
moderation_log.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
notification.ex Require related object for notifications to filter on content 2023-06-14 19:41:48 +00:00
object.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
object_tombstone.ex
otp_version.ex
pagination.ex Add /api/v1/followed_tags 2022-12-31 18:09:34 +00:00
password.ex update references to pleroma in docs 2022-12-30 03:43:35 +00:00
password_reset_token.ex
prometheus_exporter.ex Use a genserver to periodically fetch metrics 2023-01-01 18:32:14 +00:00
registration.ex
release_tasks.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
repo.ex Remove instrumentors (#98) 2022-07-21 11:32:17 +00:00
report_note.ex
reverse_proxy.ex Sanitise Content-Type of media proxy URLs 2024-03-18 22:33:10 -01:00
scheduled_activity.ex
search.ex Don't try removing deleted users and such from index as posts 2022-06-29 20:49:45 +01:00
signature.ex Fix invalid Date HTTP header when signing fetch requests 2023-08-07 12:43:42 +00:00
stats.ex update stats every 5 minutes 2022-12-16 17:22:56 +00:00
thread_mute.ex
upload.ex Always insert Dedupe upload filter 2024-03-18 22:33:10 -01:00
user.ex Federate user profile background 2024-02-16 16:35:51 +01:00
user_invite_token.ex
user_note.ex Make UserNote comment default to the empty string. 2023-04-27 05:22:12 +00:00
user_relationship.ex fix flaky test_user_relationship_test.exs:81 2022-10-23 13:31:01 +02:00
utils.ex extend custom runtime system (#108) 2022-07-24 16:42:43 +00:00
web.ex Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
xml_builder.ex