mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 14:08:45 -04:00
0187b15c8e
* Sanitizer: block data: URI scheme, keep data:image for images FreshRSS_SimplePieCustom only disallowed the `javascript` scheme, so `data:text/html,...` URIs in feed content survived sanitization on <a href>, <iframe src>, <audio|video|source|track src>. The default CSP neutralises these on FreshRSS pages, but clients and deployments without that CSP (API WebViews, extensions using amendCsp(), proxies stripping headers) could execute them. Same class as GHSA-3fw6-j8m4-82vj / #9272. - Sanitize::is_allowed_uri(): element/attribute-aware check that still permits inert `data:image/...` on img[src], image[src], video[poster] while blocking `data:` elsewhere; replace_urls() now uses it. is_allowed_scheme() is unchanged for backward compatibility. - SimplePieCustom: disallow_uri_schemes(['javascript','data']). - Tests: 4 blocked-input cases, a data:image keep-alive test and an `unsafe:` prefix test. They fail without the patch and pass with it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Sync SimplePie https://github.com/FreshRSS/simplepie/pull/92 --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
34 lines
806 B
JSON
34 lines
806 B
JSON
{
|
|
"name": "freshrss.org/freshrss",
|
|
"description": "A free, self-hostable aggregator",
|
|
"type": "project",
|
|
"homepage": "https://freshrss.org/",
|
|
"license": "AGPL-3.0",
|
|
"repositories": [
|
|
{
|
|
"type": "git",
|
|
"url": "https://github.com/FreshRSS/simplepie.git"
|
|
},
|
|
{
|
|
"type": "git",
|
|
"url": "https://framagit.org/marienfressinaud/lib_opml.git"
|
|
}
|
|
],
|
|
"require": {
|
|
"marienfressinaud/lib_opml": "dev-main#f0e850b6394af90b898daf0e65fcc7363457b844",
|
|
"phpgt/cssxpath": "v1.6.0",
|
|
"phpmailer/phpmailer": "7.1.1",
|
|
"simplepie/simplepie": "dev-freshrss#fcfbf7769eb9b3725a1f07b609771b0d7a12b0c7"
|
|
},
|
|
"config": {
|
|
"sort-packages": true,
|
|
"vendor-dir": "./"
|
|
},
|
|
"scripts": {
|
|
"post-update-cmd": [
|
|
"git clean -d -ff -X .",
|
|
"find . -name '.git' -type d -exec rm -rf {} + || true"
|
|
]
|
|
}
|
|
}
|