Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport security fixes from upstream #494

Merged
merged 8 commits into from
Jul 6, 2023
Merged

Backport security fixes from upstream #494

merged 8 commits into from
Jul 6, 2023

Commits on Jul 5, 2023

  1. Add hardened headers to user-uploaded files

    @ClearlyClaire
    ClearlyClaire committed Jul 5, 2023
    Configuration menu
    Copy the full SHA
    98874d3 View commit details
    Browse the repository at this point in the history

  2. Add a restrictive ImageMagick security policy tailored for Mastodon

    @ClearlyClaire
    ClearlyClaire committed Jul 5, 2023
    Configuration menu
    Copy the full SHA
    d6a8264 View commit details
    Browse the repository at this point in the history

  3. Reject unprocessable audio/video files instead of keeping them unchanged

    @ClearlyClaire
    ClearlyClaire committed Jul 5, 2023
    Configuration menu
    Copy the full SHA
    5884331 View commit details
    Browse the repository at this point in the history

  4. Fix timeout handling of outbound HTTP requests 

    Signed-off-by: Claire <[email protected]>
    @ClearlyClaire
    ClearlyClaire committed Jul 5, 2023
    Configuration menu
    Copy the full SHA
    e478fd3 View commit details
    Browse the repository at this point in the history

  5. Use CLOCK_MONOTONIC instead of Time.now 

    Signed-off-by: Claire <[email protected]>
    @ClearlyClaire
    ClearlyClaire committed Jul 5, 2023
    Configuration menu
    Copy the full SHA
    ff0f53c View commit details
    Browse the repository at this point in the history

  6. Tighten allowed HTML in oEmbed-based preview cards 

    Signed-off-by: Claire <[email protected]>
    @ClearlyClaire
    ClearlyClaire committed Jul 5, 2023
    Configuration menu
    Copy the full SHA
    c7bd7d0 View commit details
    Browse the repository at this point in the history

  7. Sanitize preview cards at render time 

    Signed-off-by: Claire <[email protected]>
    @ClearlyClaire
    ClearlyClaire committed Jul 5, 2023
    Configuration menu
    Copy the full SHA
    87e8d6d View commit details
    Browse the repository at this point in the history

  8. Add sandbox attribute to preview card iframes 

    Signed-off-by: Claire <[email protected]>
    @ClearlyClaire
    ClearlyClaire committed Jul 5, 2023
    Configuration menu
    Copy the full SHA
    75d759c View commit details
    Browse the repository at this point in the history