Compare commits
4 Commits
88c39ee1d4
...
53cf9d4e20
Author | SHA1 | Date | |
---|---|---|---|
53cf9d4e20 | |||
|
fb4aa9f725 | ||
|
be075a4336 | ||
|
ac977bdb1c |
@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
|
|||||||
|
|
||||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
|
||||||
|
|
||||||
|
## 2.6.2
|
||||||
|
|
||||||
|
### Security
|
||||||
|
- MRF StealEmojiPolicy: Sanitize shortcodes (thanks to Hazel K for the report
|
||||||
|
|
||||||
## 2.6.1
|
## 2.6.1
|
||||||
### Changed
|
### Changed
|
||||||
- - Document maximum supported version of Erlang & Elixir
|
- - Document maximum supported version of Erlang & Elixir
|
||||||
|
@ -34,6 +34,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do
|
|||||||
|> Path.basename()
|
|> Path.basename()
|
||||||
|> Path.extname()
|
|> Path.extname()
|
||||||
|
|
||||||
|
shortcode = Path.basename(shortcode)
|
||||||
file_path = Path.join(emoji_dir_path, shortcode <> (extension || ".png"))
|
file_path = Path.join(emoji_dir_path, shortcode <> (extension || ".png"))
|
||||||
|
|
||||||
case File.write(file_path, response.body) do
|
case File.write(file_path, response.body) do
|
||||||
@ -76,6 +77,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do
|
|||||||
new_emojis =
|
new_emojis =
|
||||||
foreign_emojis
|
foreign_emojis
|
||||||
|> Enum.reject(fn {shortcode, _url} -> shortcode in installed_emoji end)
|
|> Enum.reject(fn {shortcode, _url} -> shortcode in installed_emoji end)
|
||||||
|
|> Enum.reject(fn {shortcode, _url} -> String.contains?(shortcode, ["/", "\\"]) end)
|
||||||
|> Enum.filter(fn {shortcode, _url} ->
|
|> Enum.filter(fn {shortcode, _url} ->
|
||||||
reject_emoji? =
|
reject_emoji? =
|
||||||
[:mrf_steal_emoji, :rejected_shortcodes]
|
[:mrf_steal_emoji, :rejected_shortcodes]
|
||||||
|
@ -138,6 +138,7 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
|
|||||||
|> add_csp_param(script_src)
|
|> add_csp_param(script_src)
|
||||||
|> add_csp_param(insecure)
|
|> add_csp_param(insecure)
|
||||||
|> add_csp_param(report)
|
|> add_csp_param(report)
|
||||||
|
|> add_csp_param("frame-src https://music.yandere.cc")
|
||||||
|> :erlang.iolist_to_binary()
|
|> :erlang.iolist_to_binary()
|
||||||
end
|
end
|
||||||
|
|
||||||
|
2
mix.exs
2
mix.exs
@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
|
|||||||
def project do
|
def project do
|
||||||
[
|
[
|
||||||
app: :pleroma,
|
app: :pleroma,
|
||||||
version: version("2.6.1"),
|
version: version("2.6.2"),
|
||||||
elixir: "~> 1.11",
|
elixir: "~> 1.11",
|
||||||
elixirc_paths: elixirc_paths(Mix.env()),
|
elixirc_paths: elixirc_paths(Mix.env()),
|
||||||
compilers: [:phoenix] ++ Mix.compilers(),
|
compilers: [:phoenix] ++ Mix.compilers(),
|
||||||
|
@ -60,6 +60,32 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicyTest do
|
|||||||
|> File.exists?()
|
|> File.exists?()
|
||||||
end
|
end
|
||||||
|
|
||||||
|
test "rejects invalid shortcodes", %{path: path} do
|
||||||
|
message = %{
|
||||||
|
"type" => "Create",
|
||||||
|
"object" => %{
|
||||||
|
"emoji" => [{"fired/fox", "https://example.org/emoji/firedfox"}],
|
||||||
|
"actor" => "https://example.org/users/admin"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fullpath = Path.join(path, "fired/fox.png")
|
||||||
|
|
||||||
|
Tesla.Mock.mock(fn %{method: :get, url: "https://example.org/emoji/firedfox"} ->
|
||||||
|
%Tesla.Env{status: 200, body: File.read!("test/fixtures/image.jpg")}
|
||||||
|
end)
|
||||||
|
|
||||||
|
clear_config(:mrf_steal_emoji, hosts: ["example.org"], size_limit: 284_468)
|
||||||
|
|
||||||
|
refute "firedfox" in installed()
|
||||||
|
refute File.exists?(path)
|
||||||
|
|
||||||
|
assert {:ok, _message} = StealEmojiPolicy.filter(message)
|
||||||
|
|
||||||
|
refute "fired/fox" in installed()
|
||||||
|
refute File.exists?(fullpath)
|
||||||
|
end
|
||||||
|
|
||||||
test "reject regex shortcode", %{message: message} do
|
test "reject regex shortcode", %{message: message} do
|
||||||
refute "firedfox" in installed()
|
refute "firedfox" in installed()
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user