Repository navigation
Conversation
build-images.yml now calls ci.yml via workflow_call and the build job needs it, so a failing commit no longer publishes :dev (which keel auto-deploys). dev/main are excluded from ci.yml's push trigger to avoid running CI twice. Closes #288 Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
Use a shared toPublicUser() helper so user responses never include passwordHash, privateKey or email for other users, and sanitizeUser() for the caller's own profile. Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
…-responses fix(api): ユーザーレスポンスから非公開フィールドを除外
ci: CI 成功後にのみイメージをビルドする
- Remove image/svg+xml from the proxy allowlist; re-validate cached content types; add sandboxed CSP, nosniff and Content-Disposition to every proxy response; stop echoing upstream status/content-type - /proxy/avatar now calls the proxy logic directly instead of self-fetching via the request Host - securityHeaders no longer overwrites a route-specific CSP - Add lib/safeFetch (isPrivateAddress, assertPublicUrl, safeFetch) with DNS resolution checks and per-hop redirect re-validation; ALLOW_PRIVATE_NETWORK_FETCH=true escape hatch for development - Use safeFetch for ActivityPub object fetches, inbox delivery, WebPush, nodeinfo, instance icons, remote emoji import and Misskey API calls - RemoteFetchService rejects non-JSON (activity/ld/json) responses; WebFinger accepts jrd+json Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
…ce object origin
- verifySignature: validate keyId (http(s), no dot segments/backslashes,
not local host), require fetched document's publicKey.id === keyId and
owner === document id (or same-origin standalone Key doc), cache
{publicKeyPem, owner} (legacy string entries treated as a miss), and
expose the verified owner as c.get("signatureActor")
- activityValidation/inbox: replace keyId.startsWith(actor) with exact
activity.actor === verified owner; reject local-host actors
- CreateHandler: require attributedTo === actor and same-origin http(s) id
- AnnounceHandler: require fetched id same-origin with requested URI,
reject local authors, resolve local notes by id instead of self-fetch
- RemoteNoteService.processNote: reject non-http(s) ids (stored XSS via
note.uri), local attributedTo, cross-origin id/author; return existing
local note for local ids instead of creating
- Update/DeleteHandler: refuse to modify local users/notes
- Add unit tests for all of the above
Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
…egacy register, guard remote URLs - OAuthService: never auto-link a provider login to an existing local account by email; refuse with "An account with this email already exists. Log in and link the provider from settings." Only verified provider emails are used (GitHub /user/emails verified, Google verified_email/email_verified, Discord verified); otherwise a placeholder email is stored. - OAuth sign-up now honours registration.enabled, invite-only / REQUIRE_INVITATION, blocked usernames and the user:beforeRegister plugin hook. Already-linked users can still log in. - routes/oauth: call requireAuth() (it was passed uncalled, so link/unlink/ accounts never worked). Add POST /:provider/link/authorize; the link state cookie is bound to the initiating session token and the callback links to that session's user. POST /:provider/link requires matching state. - unlinkAccount treats OAuth placeholder password hashes as no password. - Extract registration policy helpers to lib/registrationPolicy.ts (shared by /api/auth/register and OAuth). - Remove legacy POST /api/users, which bypassed all registration gating (unused by the frontend). - Frontend: add toSafeHttpUrl and use it for remote note.uri in NoteCardMenu (open in new tab / copy / share) and MFM url/link nodes. Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
fix(security): メディアプロキシの SVG 配信停止と外部 fetch の SSRF 対策
…ed notes Followers-only and specified (DM) notes were readable by anyone through several endpoints. Introduce Misskey-compatible visibility rules and apply them everywhere notes are returned. - Add lib/noteVisibility.ts (canViewNote, isNoteVisibleTo, isPubliclyVisible) - Add optional TimelineOptions.visibleTo filter to INoteRepository, implemented in pg, mysql and sqlite repositories (EXISTS on follows, mentions match, reply-target author) - /api/notes/show, /user-notes, /replies: viewer-aware filtering (404 / empty) - Home, social and list timelines: filter non-visible notes (list membership does not imply following); hydrated reply/renote targets are filtered too - /api/mentions: apply viewer filter - AP /notes/:id and outbox: serve only public/home, non-local-only notes with correct addressing for home (unlisted) - oEmbed and reaction endpoints: hide non-public / non-visible notes - Reject replies to invisible notes and renotes of others' non-public notes - Stream pushes no longer embed non-public reply/renote targets; list notifications skip owners who cannot see the note - Tests: unit tests for visibility rules, route-level tests, sqlite integration tests for the repository filter Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
fix(security): OAuth のメール自動リンク廃止・登録制限の統一・非 http URI の無害化
fix(security): フォロワー限定・ダイレクト投稿の公開範囲を全取得経路で適用
- verifySignature: replace same-origin trust with Mastodon-style owner verification. Accept the key document directly only when it is the owner's actor document served from exactly the requested URL (no redirect); otherwise fetch the owner actor (no redirect, id === owner) and require it to list a key with id === keyId and identical PEM. Covers GoToSocial /main-key stubs and /publickey Key documents. - safeFetch: add safeFetchWithFinalUrl; RemoteFetchService exposes finalUrl and rejects cross-origin redirects by default (allowCrossOriginRedirect opt-in, used for WebFinger) - AnnounceHandler: require fetched id === requested URI, otherwise refetch once by canonical id and require an exact match; reject cross-origin final URLs; reject non-public/home, localOnly or deleted targets; derive renote visibility from to/cc; require activity.id to be http(s) on the actor's origin - activityValidation: activity.id must be http(s) and same origin as the actor (prevents javascript: ids and dedup/URI squatting) - federationUrl/RemoteActorService: normalize hostnames (lowercase, trailing dot) for local-host detection - Tests for all of the above Claude-Session: https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv
fix(federation): 署名者と actor の厳密な紐付けとオブジェクト起源の検証
chore: bump version to 2026.10.2
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 6 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
セキュリティ修正リリース。
含まれる変更（v2026.10.1 以降）
セルフホスト向けの注意
POST /api/usersを削除しました。POST /api/auth/registerを使用してくださいALLOW_PRIVATE_NETWORK_FETCH=trueが必要です（本番では設定しないでください）https://claude.ai/code/session_01Y29fBeRP344FME6de48wUv