Updated csp parameters

CHANGELOG.md

@@ -4,11 +4,6 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
-## 2.6.2
-
-### Security
-- MRF StealEmojiPolicy: Sanitize shortcodes (thanks to Hazel K for the report
-
 ## 2.6.1
 ### Changed
 - - Document maximum supported version of Erlang & Elixir

lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex

@@ -34,7 +34,6 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do
           |> Path.basename()
           |> Path.extname()
 
-        shortcode = Path.basename(shortcode)
         file_path = Path.join(emoji_dir_path, shortcode <> (extension || ".png"))
 
         case File.write(file_path, response.body) do
@@ -77,7 +76,6 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do
       new_emojis =
         foreign_emojis
         |> Enum.reject(fn {shortcode, _url} -> shortcode in installed_emoji end)
-        |> Enum.reject(fn {shortcode, _url} -> String.contains?(shortcode, ["/", "\\"]) end)
         |> Enum.filter(fn {shortcode, _url} ->
           reject_emoji? =
             [:mrf_steal_emoji, :rejected_shortcodes]

mix.exs

@@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
   def project do
     [
       app: :pleroma,
-      version: version("2.6.2"),
+      version: version("2.6.1"),
       elixir: "~> 1.11",
       elixirc_paths: elixirc_paths(Mix.env()),
       compilers: [:phoenix] ++ Mix.compilers(),

test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs

@@ -60,32 +60,6 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicyTest do
            |> File.exists?()
   end
 
-  test "rejects invalid shortcodes", %{path: path} do
-    message = %{
-      "type" => "Create",
-      "object" => %{
-        "emoji" => [{"fired/fox", "https://example.org/emoji/firedfox"}],
-        "actor" => "https://example.org/users/admin"
-      }
-    }
-
-    fullpath = Path.join(path, "fired/fox.png")
-
-    Tesla.Mock.mock(fn %{method: :get, url: "https://example.org/emoji/firedfox"} ->
-      %Tesla.Env{status: 200, body: File.read!("test/fixtures/image.jpg")}
-    end)
-
-    clear_config(:mrf_steal_emoji, hosts: ["example.org"], size_limit: 284_468)
-
-    refute "firedfox" in installed()
-    refute File.exists?(path)
-
-    assert {:ok, _message} = StealEmojiPolicy.filter(message)
-
-    refute "fired/fox" in installed()
-    refute File.exists?(fullpath)
-  end
-
   test "reject regex shortcode", %{message: message} do
     refute "firedfox" in installed()