Frédéric Guillot
168a870c02
Move internal packages to an internal folder
...
For reference: https://go.dev/doc/go1.4#internalpackages
2023-08-10 20:29:34 -07:00
Frédéric Guillot
c234903255
Rename Miniflux package name to follow Go module naming convention
...
For reference: https://go.dev/ref/mod#major-version-suffixes
2023-08-09 22:10:44 -07:00
fred
8646d61182
Replace copyright header with SPDX identifier
2023-06-19 15:00:45 -07:00
Frédéric Guillot
eb9508502c
Avoid XSS when opening a broken image due to unescaped ServerError in proxy handler
...
Creating an RSS feed item with the inline description containing an `<img>` tag
with a `srcset` attribute pointing to an invalid URL like
`http:a<script>alert(1)</script>`, we can coerce the proxy handler into an error
condition where the invalid URL is returned unescaped and in full.
This results in JavaScript execution on the Miniflux instance as soon as the
user is convinced to open the broken image.
2023-03-12 22:36:03 -07:00
Romain de Laage
2c2700a31d
Proxy support for several media types
...
closes #615
closes #635
2023-02-25 15:57:59 -08:00
Romain de Laage
3f14d08095
Proxify images in API responses
2022-10-27 17:33:18 -07:00
Frédéric Guillot
b113af8472
Omit User-Agent header in image proxy to avoid being blocked
2022-01-09 20:23:35 -08:00
Frédéric Guillot
2309b27458
Use custom feed user agent to fetch website icon
2022-01-08 15:20:18 -08:00
Frédéric Guillot
2935aaef45
Add Content-Security-Policy header to feed icon url
...
- SVG images could contains Javascript. This CSP blocks inline script.
- Feed icons are served using <img> tag and Javascript is not interpreted.
See https://developer.mozilla.org/en-US/docs/Web/SVG/SVG_as_an_Image#restrictions
2022-01-02 17:38:53 -08:00
Frédéric Guillot
2cf9bde1af
Show correct User Agent in input placeholders
2020-12-16 21:30:22 -08:00
Frédéric Guillot
3379429329
Log image proxy URL in debug mode
2019-09-22 11:38:45 -07:00
Peter De Wachter
937492f6f5
Do not buffer responses in the image proxy
...
The image proxy buffered the whole image before sending it to the
browser. If the image is large and/or hosted on a slow server, this
caused a long delay before the user's browser could display anything.
2019-09-10 20:43:44 -07:00
Frédéric Guillot
5a69a61d48
Move UI middlewares and routes to ui package
2018-11-11 11:29:12 -08:00
Frédéric Guillot
1f58b37a5e
Refactor HTTP response builder
2018-10-08 15:31:58 -07:00
Frédéric Guillot
9d08139f43
Improve request package and add more unit tests
2018-09-23 21:02:26 -07:00
Frédéric Guillot
dbcc5d8a97
Use canonical imports
2018-08-24 21:56:39 -07:00
Frédéric Guillot
f49b42f70f
Use vanilla HTTP handlers (refactoring)
2018-04-29 16:35:04 -07:00
Frédéric Guillot
1eba1730d1
Move HTTP client to its own package
2018-04-28 10:51:07 -07:00
Frédéric Guillot
320d1b0167
Refactor packages to have more idiomatic code base
2018-01-02 22:04:48 -08:00
