07c939d84f
Fix: infinite recursion in sanitizeHTML() when maxLength truncation doesn't converge ( #9043 )
...
* Fix: infinite recursion in sanitizeHTML() when maxLength truncation doesn't converge
Sanitizing can grow a truncated HTML fragment (e.g. an unclosed tag gets
auto-closed), so the previous recursive shrink-and-retry could hit a fixed
point and recurse forever, crashing on a stack overflow. Bound the retries
and fall back to a hard truncation that always terminates.
Add unit tests for FreshRSS_SimplePieCustom::sanitizeHTML(), the XSS
sanitization applied to all untrusted feed content, which had no coverage.
* Update app/Models/SimplePieCustom.php
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com >
* Some refactoring
Avoid two mb_strcut in a row. More cases for fallback. Better fallback. More edge cases.
* Address trailing incomplete tag or entity
* Whitespace reduction
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com >
2026-08-28 08:47:04 +02:00
Inverle and Alexandre Alapetite
a84c0a8bc2
Fix all broken links in the entire repository ( #9207 )
...
* Fix all broken links in the entire repository
* Update docs/CHANGELOG-old2.md
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Update config.default.php
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Update README.md
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Update docs/i18n/freshrss.fr.po
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Update docs/i18n/templates/freshrss.pot
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Update README.md
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Update docs/fr/users/01_Installation.md
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Update docs/fr/users/01_Installation.md
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Update docs/en/internationalization.md
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
* Manual fixes, preferences
* Prefer canonical when known, prefer shorter, prefer roots, prefer URLs with content negotation (e.g. language preference)
* Keep 302, 307 unchanged
* Use only `.example`, `example.net` or similarly reserved domains for URL examples
* Fix language negotiation for developer.mozilla.org
* Restore a Stackoverflow 302
* Fix some example.com
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
2026-08-19 16:19:21 +02:00
Inverle and Alexandre Alapetite
1349c7c1a9
SimplePie: Disallow javascript: URI protocol ( #8263 )
...
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7924
https://github.com/FreshRSS/simplepie/pull/80
https://github.com/FreshRSS/simplepie/pull/65
* SimplePie: Disallow `javascript:` URI protocol
* Sync SimplePie
* Update code to work with SimplePie again
* Partial revert previous commit
* Bump SimplePie
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
2026-06-13 21:15:36 +02:00
226239d157
Bump phpstan/phpstan from 2.1.46 to 2.1.54 ( #8753 )
...
* Bump phpstan/phpstan from 2.1.46 to 2.1.54
---
updated-dependencies:
- dependency-name: phpstan/phpstan
dependency-version: 2.1.54
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
* Fixes some PHPStan issues, including compatibility PHP 8.2-
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8713
Co-authored-by: Copilot <copilot@github.com >
* Bump PHPStan-strict-rules
* Fix PHPStan for PHP 8.3
* Ignore PHPStan warning for PHP 8.2 and PHP 8.3
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr >
Co-authored-by: Copilot <copilot@github.com >
2026-05-02 21:16:27 +02:00
Alexandre Alapetite
497d6a7afb
Limit cURL to protocols HTTP, HTTPS ( #8713 )
2026-04-22 22:27:17 +02:00
Luca Olivetti
bb786f4ade
add allowfullscreen to iframe ( #8467 )
...
With the "allowfullscreen" attribute it's possible to view an embedded video in full screen.
2026-01-28 08:28:23 +01:00
Alexandre Alapetite
00cd5df294
Use native PHP #[Deprecated] ( #8325 )
...
https://php.watch/versions/8.4/Deprecated
And enfore it with PHPUnit + PHPStan.
Especially useful for extensions.
2025-12-17 10:11:18 +01:00
Alexandre Alapetite
76f5bee76d
Better merging of custom HTTP headers ( #8251 )
...
Alternative to https://github.com/FreshRSS/FreshRSS/pull/8246
See https://github.com/FreshRSS/FreshRSS/issues/8189#issuecomment-3569434305
2025-11-27 23:31:03 +01:00
Alexandre Alapetite
a18c35046d
Housekeeping lib_rss.php ( #8193 )
...
* Housekeeping lib_rss.php
`lib_rss.php` had become much too large, especially after https://github.com/FreshRSS/FreshRSS/pull/7924
Moved most functions to other places.
Mostly no change of code otherwise (see comments).
* Extension: composer run-script phpstan-third-party
2025-11-11 08:17:12 +01:00
