Frédéric Guillot
e7ccf0aa1e
Add SaveEntry function to API client
2023-07-30 15:52:49 -07:00
fred
8646d61182
Replace copyright header with SPDX identifier
2023-06-19 15:00:45 -07:00
Frédéric Guillot
eb9508502c
Avoid XSS when opening a broken image due to unescaped ServerError in proxy handler
...
Creating an RSS feed item with the inline description containing an `<img>` tag
with a `srcset` attribute pointing to an invalid URL like
`http:a<script>alert(1)</script>`, we can coerce the proxy handler into an error
condition where the invalid URL is returned unescaped and in full.
This results in JavaScript execution on the Miniflux instance as soon as the
user is convinced to open the broken image.
2023-03-12 22:36:03 -07:00
Romain de Laage
2c2700a31d
Proxy support for several media types
...
closes #615
closes #635
2023-02-25 15:57:59 -08:00
Frédéric Guillot
cecab91298
Fix some linter issues
2022-08-08 22:06:38 -07:00
Frédéric Guillot
dd3f496d06
Avoid extra HTTP request for fetching custom stylesheet
...
Use inline CSS with a nonce and move CSP headers to a meta tag.
2021-05-31 14:29:33 -07:00
Frédéric Guillot
091308787b
Add header "Referrer-Policy: no-referrer"
...
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
2021-02-14 11:33:31 -08:00
Frédéric Guillot
864dd9f219
Allow images with data URLs
...
Only URLs with a mime-type image/* are allowed
2021-02-06 14:46:01 -08:00
Savely Krasovsky
454eb590ce
Remove child-src CSP policy (deprecated)
2020-03-31 19:50:25 -07:00
Peter De Wachter
937492f6f5
Do not buffer responses in the image proxy
...
The image proxy buffered the whole image before sending it to the
browser. If the image is large and/or hosted on a slow server, this
caused a long delay before the user's browser could display anything.
2019-09-10 20:43:44 -07:00
Frédéric Guillot
1ff9950a55
Remove charset=utf-8 from JSON responses
...
See: https://www.iana.org/assignments/media-types/application/json
2018-11-03 12:03:06 -07:00
Frédéric Guillot
11dfcdd3d6
Fix typo in license header
2018-10-08 15:50:15 -07:00
Frédéric Guillot
1f58b37a5e
Refactor HTTP response builder
2018-10-08 15:31:58 -07:00
Frédéric Guillot
dbcc5d8a97
Use canonical imports
2018-08-24 21:56:39 -07:00
Frédéric Guillot
9f6533ece9
Compress JSON, CSS and Javascript responses
2018-07-19 19:27:05 -07:00
Frédéric Guillot
34a3fe426b
Compress HTML responses to Gzip/Deflate if supported by browser
2018-07-06 20:39:28 -07:00
Frédéric Guillot
f49b42f70f
Use vanilla HTTP handlers (refactoring)
2018-04-29 16:35:04 -07:00
