Commit graph

17 commits

Author SHA1 Message Date
0ec62acb9d Always insert Dedupe upload filter
This actually was already intended before to eradict all future
path-traversal-style exploits and to fix issues with some
characters like akkoma#610 in 0b2ec0ccee. However, Dedupe and
AnonymizeFilename got mixed up. The latter only anonymises the name
in Content-Disposition headers GET parameters (with link_name),
_not_ the upload path.

Even without Dedupe, the upload path is prefixed by an UUID,
so it _should_ already be hard to guess for attackers. But now
we actually can be sure no path shenanigangs occur, uploads
reliably work and save some disk space.

While this makes the final path predictable, this prediction is
not exploitable. Insertion of a back-reference to the upload
itself requires pulling off a successfull preimage attack against
SHA-256, which is deemed infeasible for the foreseeable futures.

Dedupe was already included in the default list in config.exs
since 28cfb2c37a, but this will get overridde by whatever the
config generated by the "pleroma.instance gen" task chose.

Upload+delete tests running in parallel using Dedupe might be flaky, but
this was already true before and needs its own commit to fix eventually.
2024-03-18 22:33:10 -01:00
364b6969eb Use finch everywhere (#33)
Some checks failed
ci/woodpecker/push/lint Pipeline failed
ci/woodpecker/push/test unknown status
ci/woodpecker/push/release Pipeline was successful
Reviewed-on: #33
2022-07-04 16:30:38 +00:00
Alex Gleason
2ce7dae6de
Skip erratic tests 2021-12-21 22:04:15 -06:00
Haelwenn (lanodan) Monnier
c4439c630f
Bump Copyright to 2021
grep -rl '# Copyright © .* Pleroma' * | xargs sed -i 's;Copyright © .* Pleroma .*;Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>;'
2021-01-13 07:49:50 +01:00
Alexander Strizhakov
56ff02f2ef
removing GunMock to use Mox 2020-03-06 20:23:58 +03:00
Mark Felder
05da5f5cca Update Copyrights 2020-03-03 16:44:49 -06:00
stwf
bd1984f054 update tests and Oban 2019-11-26 15:24:34 -05:00
lain
717d246491 Tests: Don't run federated tests by default 2019-11-26 15:03:16 -05:00
rinpatch
b0ec82d24a Merge branch 'chores/bump-copyright-year' into 'develop'
Bump copyright years of files changed in 2019

See merge request pleroma/pleroma!1698
2019-09-18 21:57:49 +00:00
Haelwenn (lanodan) Monnier
447514dfa2
Bump copyright years of files changed in 2019
Done via the following command:
git diff 1e6c102bfc --stat --name-only | cat - | xargs sed -i 's/2017-2018 Pleroma Authors/2017-2019 Pleroma Authors/'
2019-09-18 23:21:11 +02:00
rinpatch
a12aeb09c4 Cleanup uploads after the tests are finished 2019-09-18 23:34:13 +03:00
Sergey Suprunenko
9340896c9e Exclude tests that use :crypt.crypt/2 on macOS 2019-07-22 19:54:22 +00:00
Alexander Strizhakov
4e6e5d8042 reverse proxy tests 2019-07-09 16:54:13 +00:00
William Pitcock
3c08d229db tests: add legal boilerplate 2018-12-23 20:57:10 +00:00
lain
4afbef39f4 Format the code. 2018-03-30 15:01:53 +02:00
Roger Braun
4cac385411 Add factories for testing. 2017-04-13 15:49:24 +02:00
Roger Braun
a93f3421a7 Phoenix skeleton 2017-03-17 17:09:58 +01:00