honkoma/test
Mark Felder 2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
2023-08-04 08:40:27 +02:00
..
config Load an emoji.txt specific to the test env 2021-02-03 16:40:59 -06:00
credo/check/consistency Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
fixtures Merge branch 'instance-nodeinfo-metadata' into 'develop' 2023-06-27 18:58:04 +00:00
instance_static support for special chars in pack name 2020-09-24 09:12:37 +03:00
mix Force spec for every operation to have a listed tag 2023-01-15 18:31:37 -05:00
pleroma Resolve information disclosure vulnerability through emoji pack archive download endpoint 2023-08-04 08:40:27 +02:00
support Revert MediaProxy Host header validation 2023-06-07 09:19:22 -04:00
test_helper.exs B TestHelper, CI: Work with older elixir version. 2023-02-09 12:36:02 -05:00