limepotato/akkoma
1
0
Fork 0
Code Pull requests Activity
akkoma/test/pleroma
History
Mark Felder 2c79509453 Resolve information disclosure vulnerability through emoji pack archive download endpoint 
The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org
2023-08-04 08:40:27 +02:00
..
activity Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
chat Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
config release_runtime_provider_test: Explicitely use non-existant config file 2023-06-27 00:20:29 +02:00
conversation Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
docs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
ecto_type/activity_pub/object_validators CommonFields: Use BareUri for :url 2023-05-17 17:25:46 +02:00
emails Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
emoji Resolve information disclosure vulnerability through emoji pack archive download endpoint 2023-08-04 08:40:27 +02:00
gun Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
http Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
instances instances: Store some metadata based on NodeInfo 2023-03-16 09:02:20 +01:00
integration Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
mfa Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
migration_helper Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
object Merge branch 'tusooa/rework-refetch' into 'develop' 2023-05-26 19:24:08 +02:00
password Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
repo/migrations Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
upload Add OnlyMedia Upload Filter to simplify restricting uploads to audio, image, and video types 2023-05-29 15:49:04 -04:00
uploaders Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
user Merge branch 'from/upstream-develop/tusooa/backup-status' into 'develop' 2023-06-27 12:08:11 +00:00
web Merge branch 'tusooa/3154-attachment-type-check' into 'develop' 2023-08-03 10:01:32 +00:00
workers Merge branch 'tusooa/oban-common-pipeline' into 'develop' 2023-03-30 12:43:58 +02:00
activity_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
announcement_read_relationship_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
announcement_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
application_requirements_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
bookmark_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
captcha_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
chat_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
config_db_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
config_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
conversation_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
emoji_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
filter_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
following_relationship_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
formatter_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
frontend_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
hashtag_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
healthcheck_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
html_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
http_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
instances_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
job_queue_monitor_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
keys_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
list_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
marker_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
mfa_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
moderation_log_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
notification_test.exs Require related object for notifications to filter on content 2023-02-20 12:27:50 -05:00
object_test.exs Fix emoji reactions for legacy 2-tuple formats 2023-03-26 15:12:40 -04:00
otp_version_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
pagination_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
registration_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
repo_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
report_note_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
resilience_test.exs Resilience Test: Add notification check for killing likes. 2021-01-06 12:49:18 +01:00
reverse_proxy_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
runtime_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
safe_jsonb_set_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
scheduled_activity_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
signature_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
stats_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
upload_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
user_invite_token_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
user_relationship_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
user_search_test.exs Fix warnings in tests, treat warnings as errors in CI. 2023-01-03 14:59:14 -05:00
user_test.exs User: Remove ap_enabled field 2023-05-05 11:11:26 +02:00
utils_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00
xml_builder_test.exs Revert "Merge branch 'copyright-bump' into 'develop'" 2023-01-02 20:38:50 +00:00