umputun / remark42
85%

DEFAULT BRANCH: master
Repo Added
Token eqCnozHBf54UGZ8kokrZbOvkEkhZY23aj regen
Build 1639 Last
Files 52
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: master
CHANGE BRANCH
x
Sync Branches

coverage: 84.555% (+0.3%) from 84.273%
26203935339

push

github

web-flow 
fix(security): reject non-image content-types in image proxy and /picture/ to prevent stored XSS (#2067)

* fix(security): reject non-image content-types in image proxy and /picture/ to prevent stored XSS

The /api/v1/img proxy and /api/v1/picture/{user}/{id} endpoints emitted
http.DetectContentType on the served bytes as the response Content-Type. A
controlled upstream serving Content-Type: image/png with an HTML body passed
the upstream check (only the response header was inspected, not the body),
and the body bytes then sniffed back to text/html — so the proxy served the
attacker's HTML from the remark42 origin. Browsers honoured the declared
text/html and executed the response as a document with access to cookies and
CSRF tokens. Affected from v1.6.0 (April 2020) through v1.15.0; verified live
via published docker images.

Layered defense applied to both handlers:

- rest.SafeImgContentType (in backend/app/rest/) validates sniffed content
  against a strict allowlist: image/png, image/jpeg, image/gif, image/webp,
  image/bmp, image/x-icon. Anything else (HTML, XML, SVG, plain text,
  octet-stream, or any future image type the stdlib sniffer may learn) is
  rejected with no body echo. SVG is implicitly excluded — it sniffs as
  text/xml or text/plain, never image/svg+xml, and SVG can execute scripts
  when navigated to top-level. The previous octet-stream → image/* fallback
  is gone.
- Per-endpoint Content-Security-Policy override sets
  "default-src 'none'; sandbox; frame-ancestors 'none'" on every response
  (success, 304, or error). Sandbox neuters scripts even if Content-Type
  ever regresses. The same policy is also applied to all /api/v1/* via
  apiCSPMiddleware as defense-in-depth.
- Content-Disposition: inline; filename="image" frames the response as a
  file rather than a renderable document.
- /picture/ rejection paths set Cache-Control: no-store so 4xx responses
  are never cached.

The defense headers and the strict ETag matcher are ex... (continued)

85 of 86 new or added lines in 4 files covered. (98.84%)

2 existing lines in 1 file now uncovered.

6345 of 7504 relevant lines covered (84.55%)

34.7 hits per line

Relevant lines Covered
7504 RELEVANT LINES 6345 COVERED LINES
34.7 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
26203935339 master fix(security): reject non-image content-types in image proxy and /picture/ to prevent stored XSS (#2067) * fix(security): reject non-image content-types in image proxy and /picture/ to prevent stored XSS The /api/v1/img proxy and /api/v1/picture... push web-flow github
84.55
26202461678 master fix(image): reject decompression-bomb dimensions before raster decode readAndValidateImage caps the byte size of incoming images but the resize() helper that follows still called image.Decode unconditionally, allocating pixel memory proportional ... push umputun github
84.27
26199364928 master chore(deps): bump go modules in backend and example Backend (backend/go.mod): - github.com/go-pkgz/auth/v2 v2.1.2 → v2.1.4 - github.com/klauspost/compress v1.18.5 → v1.18.6 - github.com/redis/go-redis/v9 v9.18.0 → v9.19.0 - github.com/slack-go/sl... push umputun github
84.25
25420889359 master Merge pull request #2052 from umputun/dependabot/go_modules/backend/go-modules-updates-47fdc5c9f4 chore(deps): bump the go-modules-updates group in /backend with 2 updates push web-flow github
84.25
24753077072 master fix(auth): close OAuth open-redirect by wiring AllowedRedirectHosts (#2049) * fix(auth): close OAuth open-redirect by wiring AllowedRedirectHosts Bump go-pkgz/auth/v2 to master (v2.1.2-0.20260421203319-686683f19cf7) which carries the `from` redi... push web-flow github
84.25
24600086020 master test: use testing/synctest to eliminate wall-clock sleeps (#2048) Go 1.25's testing/synctest package (GA) provides a fake clock bubble for deterministic goroutine and timer testing. Convert tests that waited on real-time durations to use synctest... push web-flow github
84.25
24599629279 master fix(api): drop QR-write nolint dup + trim dead `..` check Address PR #2045 review (umputun): * The //nolint:gosec on telegramQrCtrl's w.Write(png) was byte-identical to the same line in #2044 (gosec-rule restoration). Drop it here so the two... push umputun github
84.13
24592734878 master test(store): use time.UTC in test fixtures to be timezone-agnostic The store tests stored timestamps with time.Local in their fixtures and asserted equality against returned values that the engine round-trips through UTC. assert.Equal compares zo... push umputun github
84.13
24592686760 master fix(api): require explicit ?site= in matchSiteID middleware matchSiteID guarded most authenticated and admin routes with `if siteID != "" && user.SiteID != siteID`. Dropping the ?site= query parameter made the check no-op and any authenticated us... push umputun github
84.16
24547191483 master feat: custom oauth2 provider (#2006) * feat: add configurable custom OAuth2 provider and icons * fix: reserve built-in custom provider names * fix: add nolint directive for sha1 import * fix: harden custom oauth provider validation push web-flow github
84.35
See All Builds (1596)