ilja/akkoma
1
0
Fork 0
forked from AkkomaGang/akkoma
Code Issues Pull requests Projects Releases Packages Wiki Activity
akkoma/test/pleroma
History
Oneric 0ec62acb9d Always insert Dedupe upload filter 
This actually was already intended before to eradict all future
path-traversal-style exploits and to fix issues with some
characters like akkoma#610 in 0b2ec0ccee. However, Dedupe and
AnonymizeFilename got mixed up. The latter only anonymises the name
in Content-Disposition headers GET parameters (with link_name),
_not_ the upload path.

Even without Dedupe, the upload path is prefixed by an UUID,
so it _should_ already be hard to guess for attackers. But now
we actually can be sure no path shenanigangs occur, uploads
reliably work and save some disk space.

While this makes the final path predictable, this prediction is
not exploitable. Insertion of a back-reference to the upload
itself requires pulling off a successfull preimage attack against
SHA-256, which is deemed infeasible for the foreseeable futures.

Dedupe was already included in the default list in config.exs
since 28cfb2c37a, but this will get overridde by whatever the
config generated by the "pleroma.instance gen" task chose.

Upload+delete tests running in parallel using Dedupe might be flaky, but
this was already true before and needs its own commit to fix eventually.
2024-03-18 22:33:10 -01:00
..
activity Prune old Update activities 2024-02-17 16:57:40 +01:00
akkoma Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
collections GTS: cherry-picks and collection usage (#186) 2022-08-27 18:05:48 +00:00
config release_runtime_provider_test: chmod config for hardened permissions 2023-08-04 14:14:04 -04:00
conversation fix flaky participation_test.exs 2022-10-23 12:33:31 +02:00
docs backend-i18n (#121) 2022-07-27 21:56:59 +00:00
ecto_type/activity_pub/object_validators Pipeline Ingestion: Note 2021-04-05 19:19:11 +02:00
emails Correct email links to be absolute URLs 2023-11-02 11:49:03 +00:00
emoji Merge branch 'elixir1.15' into develop 2023-08-04 15:16:14 +01:00
http Support elixir1.15 2023-08-03 17:44:09 +01:00
instances Don't mess with the cache on metadata update 2022-11-08 10:39:01 +00:00
integration Migrate to phoenix 1.7 (#626) 2023-08-15 10:22:18 +00:00
mfa Put matchers in matchers subpackage 2023-08-06 15:53:04 +01:00
migration_helper purge chat and shout endpoints 2022-07-21 11:29:28 +01:00
object Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
password Pbkdf2: Use it everywhere. 2021-01-14 15:06:16 +01:00
repo/migrations Another keyword.equal? check 2023-08-06 16:36:18 +01:00
search Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
translators Add MRFs for direct message manipulation 2023-05-22 23:53:44 +01:00
upload Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
uploaders Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
user Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
web Always insert Dedupe upload filter 2024-03-18 22:33:10 -01:00
workers Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
activity_test.exs Merge branch 'features/validators-note' into 'develop' 2021-06-01 01:51:38 +00:00
announcement_read_relationship_test.exs Merge branch 'from/upstream-develop/tusooa/server-announcements' into 'develop' (#85) 2022-07-18 13:08:36 +00:00
announcement_test.exs Merge branch 'from/upstream-develop/tusooa/server-announcements' into 'develop' (#85) 2022-07-18 13:08:36 +00:00
application_requirements_test.exs Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
bookmark_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
captcha_test.exs Convert tests to all use clear_config instead of Pleroma.Config.put 2021-01-26 11:58:43 -06:00
config_db_test.exs Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
config_test.exs Convert tests to all use clear_config instead of Pleroma.Config.put 2021-01-26 11:58:43 -06:00
conversation_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
emoji_test.exs Fix emoji qualification (#124) 2022-07-28 12:02:36 +00:00
filter_test.exs support for expires_in/expires_at in filters 2021-01-26 08:27:45 +03:00
following_relationship_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
formatter_test.exs CI: Bump lint stage to elixir-1.12 2021-10-06 08:11:05 +02:00
frontend_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
hashtag_test.exs [#3213] Ignoring of blank elements from objects.data->tag. 2021-01-21 20:50:06 +03:00
healthcheck_test.exs Add unordered list equality matcher 2023-08-06 15:58:11 +01:00
html_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
http_test.exs mix format 2022-06-11 16:14:31 +01:00
instances_test.exs Add Signed Fetch Statistics (#312) 2022-11-26 19:22:56 +00:00
iso639_test.exs add inbound language test 2023-01-11 15:42:13 +00:00
job_queue_monitor_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
keys_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
list_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
marker_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
mfa_test.exs argon2 password hashing (#406) 2022-12-30 02:46:58 +00:00
moderation_log_test.exs CI: Bump lint stage to elixir-1.12 2021-10-06 08:11:05 +02:00
notification_test.exs Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
object_test.exs Always insert Dedupe upload filter 2024-03-18 22:33:10 -01:00
otp_version_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
pagination_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
password_test.exs argon2 password hashing (#406) 2022-12-30 02:46:58 +00:00
registration_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
repo_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
report_note_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
reverse_proxy_test.exs Support elixir1.15 2023-08-03 17:44:09 +01:00
runtime_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
safe_jsonb_set_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
scheduled_activity_test.exs Convert tests to all use clear_config instead of Pleroma.Config.put 2021-01-26 11:58:43 -06:00
signature_test.exs Fix signature checking 2023-08-07 16:17:17 +01:00
stats_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
upload_test.exs Always insert Dedupe upload filter 2024-03-18 22:33:10 -01:00
user_invite_token_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00
user_note_test.exs Add user_note_test.exs. 2023-05-12 02:18:24 +00:00
user_relationship_test.exs Tag Mock-tests as "mocked" and run them seperately 2023-08-04 12:50:50 +01:00
user_search_test.exs fix tests broken by relay defaults changing (#314) 2022-11-26 20:45:47 +00:00
user_test.exs fix issue with API cascading domain blocks but not honouring them 2023-08-25 11:00:49 +01:00
utils_test.exs extend custom runtime system (#108) 2022-07-24 16:42:43 +00:00
xml_builder_test.exs Bump Copyright to 2021 2021-01-13 07:49:50 +01:00