github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-05-11 02:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,831 Commits 215 Branches 276 Tags
Commit Graph

34 Commits

Author SHA1 Message Date
Andrey Antukh
279231240d
🐛 Harden outbound HTTP requests against SSRF and restrict assets handlers (#9390) 
* ⬆️ Update root deps

* 🐛 Harden outbound HTTP requests against SSRF and restrict unauthenticated asset access

- Add app.util.ssrf URL/host validator that resolves hostnames and blocks
  loopback, link-local, site-local, cloud metadata, and operator-supplied CIDRs
- Add app.media.sanitize image EOF truncator that strips trailing data after
  PNG IEND, JPEG EOI, GIF trailer, and WebP RIFF markers
- Disable HTTP client auto-redirect; add req-with-redirects! helper that
  revalidates every redirect hop against the SSRF blocklist
- Wire SSRF validation and EOF sanitization into media/download-image
- Validate webhook URLs and OIDC profile picture URLs against SSRF
- Restrict /assets/by-id to require authentication for non-public buckets
  (profile) while keeping public access for file-media-object,
  file-object-thumbnail, team-font-variant, and file-data-fragment
- Add config knobs: ssrf-protection-enabled, ssrf-allowed-hosts,
  ssrf-extra-blocked-cidrs

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
 2026-05-08 09:18:22 +02:00
Andrey Antukh
bcaf76d055 ✨ Make the virtual clock by profile and not global 
And make it affect only RPC/HTTP requests and not worker
tasks.
 2026-01-09 12:58:44 +01:00
Andrey Antukh
4fddf3d986 ♻️ Make management key derivable from secret key 
Still preserves the ability to set management
 2025-11-20 12:20:13 +01:00
Andrey Antukh
83763b46ce ✨ Add RPC methods for manage deleted files 
This includes: get already deletedf files, restore deleted files
and permanently delete files marked for deletion.
 2025-10-31 16:07:23 +01:00
Andrey Antukh
bd63598185 🎉 Add virtual clock implementation 2025-10-07 12:08:00 +02:00
Andrey Antukh
efd4a11ae2 🐛 Add support for multiple formats on clone-template 2025-01-23 08:09:23 +01:00
Pablo Alba
afb5ab7430 ✨ Rename welcome file 2024-10-25 12:23:35 +02:00
Andrey Antukh
002b1679c3 ♻️ Clean assertion and schema chechking API 2024-10-08 15:30:33 +02:00
Andrey Antukh
b882b9e283 🔥 Remove usage of public usage of sm/define funcion 2024-09-13 11:30:55 +02:00
Pablo Alba
81b7972347 🎉 Test A/B for start in workspace 2024-09-04 17:19:39 +02:00
Andrey Antukh
22757a449f ✨ Add minor performance enhancements on template setup service 2023-12-11 17:14:20 +01:00
Andrey Antukh
37e4939af7 ✨ Add usability improvements to schema validation subsystem 2023-11-23 17:19:37 +01:00
Andrey Antukh
f174264f7f 🎉 Add flex layout playground template to the dashboard carousel 2023-07-28 13:20:57 +02:00
Andrey Antukh
494c585e2f ✨ Make builtin templates download ondemand if cache is not present 2023-07-10 15:07:17 +02:00
Andrey Antukh
8468e7af24 🎉 Add admin example service to default docker compose file 2023-01-20 16:52:58 +01:00
Andrey Antukh
bafe3ec087 ⏪ Revert some changes related to admin that are no longer necessary 2023-01-13 10:19:39 +01:00
Andrey Antukh
b929564fa7 ♻️ Add admin facilities on the code base 
- Fix bugs related to orphan teams on profile deletion
- Separate session based profile-id param from api user provided
 2022-12-22 16:42:45 +01:00
Andrey Antukh
8bad9d8340 ♻️ Refactor loggers/audit, auth/oidc, and http/clent modules 2022-12-05 08:53:00 +01:00
luz paz
e30bea0b6f 🔧 Fix typos in source code 
Found via `codespell -q 3 -S *.po,./frontend/yarn.lock -L childs,clen,fpr,inflight,ody,ot,ro,te,trys,ue`
 2022-10-04 10:40:34 +02:00
Andrey Antukh
41134f22e9 📎 Update license header 2022-09-20 23:23:22 +02:00
Andrey Antukh
ec3651d85b 🎉 Add optional rate limit support for RPC calls 2022-08-31 12:55:48 +02:00
Andrey Antukh
d6d9d25fce ♻️ Refactor token generation API 2022-08-31 11:01:07 +02:00
Andrey Antukh
ed701fd9c5 ♻️ Move management mutations to commands 2022-08-03 14:28:33 +02:00
Andrey Antukh
d832482dae 🎉 Add builtin template loading mechanism 2022-08-03 14:28:33 +02:00
Andrés Moya
1894fc7cfa 🐛 Fix linter error 2021-07-06 18:08:08 +02:00
Andrey Antukh
d1cce44616 🎉 Add keys namespace. 
A modularized approach for key derivation.
 2021-07-06 10:49:27 +02:00
Andrey Antukh
188126a895 ✨ Properly use dumped objects on initial data load process. 2021-05-20 10:52:20 +02:00
Andrey Antukh
f545e41d10 📎 Fix license header. 2021-04-12 16:49:43 +02:00
Andrey Antukh
708ba3d7ac 🐛 Fix initial data loading issues. 2021-03-08 22:35:11 +01:00
Andrey Antukh
6a345c4b8a ✨ Complete backend behavior when duplicate and move 2021-03-03 12:38:34 +01:00
Andrey Antukh
52a3cd6ae4 🐛 Don't show update library message on onboarding files. 2021-03-01 16:38:28 +01:00
Andrey Antukh
f12f46981b 🐛 Add mising remap-id on onboarding files setup. 2021-03-01 15:41:39 +01:00
Andrey Antukh
2a8a0afd09 🐛 Fix many bugs on onboarding file loading process. 2021-02-28 19:58:15 +01:00
Andrey Antukh
e3727aaefe 🎉 Add onboarding data to the database. 2021-02-24 16:31:56 +01:00