akkoma/lib/pleroma/web
Oneric a4fa2ec9af StealEmoji: make final paths infeasible to predict
Certain attacks rely on predictable paths for their payloads.
If we weren’t so overly lax in our (id, URL) check, the current
counterfeit activity exploit would be one of those.
It seems plausible for future attacks to hinge on
or being made easier by predictable paths too.

In general, letting remote actors place arbitrary data at
a path within our domain of their choosing (sans prefix)
just doesn’t seem like a good idea.

Using fully random filenames would have worked as well, but this
is less friendly for admins checking emoji dirs.
The generated suffix should still be more than enough;
an attacker needs on average 140 trillion attempts to
correctly guess the final path.
2024-03-18 22:33:10 -01:00
..
activity_pub StealEmoji: make final paths infeasible to predict 2024-03-18 22:33:10 -01:00
admin_api Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
akkoma_api add selection UI 2023-03-28 12:44:52 +01:00
api_spec Merge branch 'followback' into develop 2024-02-16 13:27:40 +00:00
auth Support elixir1.15 2023-08-03 17:44:09 +01:00
common_api Support elixir1.15 2023-08-03 17:44:09 +01:00
fallback ensure we send the right files for preferred fe 2023-03-12 23:59:10 +00:00
federator Remove debug prints 2022-06-25 18:43:19 +01:00
feed Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
mailer Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
mastodon_api Merge pull request 'Return last_status_at as date, not datetime' (#681) from katafrakt/akkoma:fix-last-status-at into develop 2024-02-17 11:37:19 +00:00
media_proxy Use uppercase HTTP HEAD method for media preview proxy request (#128) 2022-07-30 21:58:14 +00:00
metadata Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
mongoose_im argon2 password hashing (#406) 2022-12-30 02:46:58 +00:00
nodeinfo Mix format 2023-04-14 17:56:34 +01:00
o_auth update tests for oauth consumer 2023-12-17 21:48:19 +00:00
o_status Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
pleroma_api Exclude deactivated users from emoji reaction lists 2023-07-17 17:53:03 +01:00
plugs Limit instance emoji to image types 2024-03-18 22:33:10 -01:00
preload/providers Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
push Support elixir1.15 2023-08-03 17:44:09 +01:00
rich_media Support elixir1.15 2023-08-03 17:44:09 +01:00
static_fe Fix Twitter metadata 2024-02-19 21:09:43 +00:00
templates Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
twitter_api Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
utils Pleroma.Web.Params --> Pleroma.Web.Utils.Params 2021-06-08 12:50:47 -05:00
views Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
web_finger giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
api_spec.ex update references to pleroma in docs 2022-12-30 03:43:35 +00:00
common_api.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
controller_helper.ex giant massive dep upgrade and dialyxir-found error emporium (#371) 2022-12-14 12:38:48 +00:00
embed_controller.ex Add embed controller tests 2023-07-17 19:18:21 +01:00
endpoint.ex Fix Content-Type of our schema 2024-03-18 22:33:10 -01:00
federator.ex and i yoink (#275) 2022-11-14 15:07:26 +00:00
gettext.ex Fix incorrect fallback when English is set to first language 2022-06-29 20:47:10 +01:00
instance_document.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
manifest_controller.ex Expose /manifest.json for PWA 2021-11-24 17:50:55 -06:00
masto_fe_controller.ex Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
media_proxy.ex Drop media proxy same-domain default for base_url 2024-03-18 22:33:10 -01:00
metadata.ex Add configurable theme color (#53) 2022-07-06 20:00:43 +00:00
o_auth.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
pipelines.ex Remove precompiled javascript (#55) 2022-07-08 13:03:18 +00:00
plug.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
preload.ex remove unused variable 2022-12-16 12:36:34 +00:00
push.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
rel_me.ex Add more information about failed verifications 2023-03-10 03:51:24 +00:00
router.ex mastodon_api: Add /api/v1/preferences endpoint 2023-08-12 09:28:24 -04:00
streamer.ex Enforce unauth restrictions for public streaming endpoints 2023-06-14 22:45:19 +00:00
swagger.ex remove anonymous function from plug 2022-07-14 11:17:14 +01:00
telemetry.ex Use fallbacks of summary metrics for prometheus 2024-02-12 02:00:09 +01:00
translation_helpers.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
uploader_controller.ex Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
web_finger.ex Support elixir1.15 2023-08-03 17:44:09 +01:00
xml.ex Add XML matcher 2023-08-07 11:12:14 +01:00