mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 05:58:40 -04:00
0187b15c8e
* Sanitizer: block data: URI scheme, keep data:image for images FreshRSS_SimplePieCustom only disallowed the `javascript` scheme, so `data:text/html,...` URIs in feed content survived sanitization on <a href>, <iframe src>, <audio|video|source|track src>. The default CSP neutralises these on FreshRSS pages, but clients and deployments without that CSP (API WebViews, extensions using amendCsp(), proxies stripping headers) could execute them. Same class as GHSA-3fw6-j8m4-82vj / #9272. - Sanitize::is_allowed_uri(): element/attribute-aware check that still permits inert `data:image/...` on img[src], image[src], video[poster] while blocking `data:` elsewhere; replace_urls() now uses it. is_allowed_scheme() is unchanged for backward compatibility. - SimplePieCustom: disallow_uri_schemes(['javascript','data']). - Tests: 4 blocked-input cases, a data:image keep-alive test and an `unsafe:` prefix test. They fail without the patch and pass with it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Sync SimplePie https://github.com/FreshRSS/simplepie/pull/92 --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Libraries
SimplePie
FreshRSS uses a forked version of SimplePie, with a number of patches.
See the read-me of our fork.
Updating libraries
Some of the libraries in this folder can be updated semi-automatically by invoking:
cd ./FreshRSS/lib/
composer update --no-autoloader
Remember to read the change-logs, proof-read the changes, preserve possible local patches, add irrelevant files to .gitignore (minimal installation), and test before committing.