Oneric bcc528b2e2 Never automatically assign privileged content types ... By mapping all extensions related to our custom privileged types back to innocuous text/plain, our custom types will never automatically be inserted which was one of the factors making impersonation possible. Note, this does not invalidate the upload and emoji Content-Type restrictions from previous commits. Apart from counterfeit AP objects there are other payloads with standard types this protects against, e.g. *.js Javascript payloads as used in prior frontend injections.		2024-03-18 22:33:10 -01:00
..
benchmark.exs	Support elixir1.15	2023-08-03 17:44:09 +01:00
config.exs	Never automatically assign privileged content types	2024-03-18 22:33:10 -01:00
custom_emoji.txt	Ship with hehe	2023-03-27 10:03:12 +01:00
description.exs	Sanitise Content-Type of uploads	2024-03-18 22:33:10 -01:00
dev.exs	use puts instead warn	2021-07-27 21:01:41 +00:00
docker.exs	Docker builds (#231)	2022-10-16 19:25:54 +00:00
dokku.exs	Switch from the deprecated "use Mix.config" to "import Config"	2021-05-20 14:02:58 -05:00
prod.exs	Switch from the deprecated "use Mix.config" to "import Config"	2021-05-20 14:02:58 -05:00
test.exs	Support elixir1.15	2023-08-03 17:44:09 +01:00