mirror of
https://github.com/penpot/penpot.git
synced 2026-05-09 01:58:46 +00:00
279231240d
* ⬆️ Update root deps * 🐛 Harden outbound HTTP requests against SSRF and restrict unauthenticated asset access - Add app.util.ssrf URL/host validator that resolves hostnames and blocks loopback, link-local, site-local, cloud metadata, and operator-supplied CIDRs - Add app.media.sanitize image EOF truncator that strips trailing data after PNG IEND, JPEG EOI, GIF trailer, and WebP RIFF markers - Disable HTTP client auto-redirect; add req-with-redirects! helper that revalidates every redirect hop against the SSRF blocklist - Wire SSRF validation and EOF sanitization into media/download-image - Validate webhook URLs and OIDC profile picture URLs against SSRF - Restrict /assets/by-id to require authentication for non-public buckets (profile) while keeping public access for file-media-object, file-object-thumbnail, team-font-variant, and file-data-fragment - Add config knobs: ssrf-protection-enabled, ssrf-allowed-hosts, ssrf-extra-blocked-cidrs Signed-off-by: Andrey Antukh <niwi@niwi.nz> --------- Signed-off-by: Andrey Antukh <niwi@niwi.nz>
25 lines
662 B
JSON
25 lines
662 B
JSON
{
|
|
"name": "penpot",
|
|
"version": "1.20.0",
|
|
"license": "MPL-2.0",
|
|
"author": "Kaleidos INC",
|
|
"private": true,
|
|
"packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/penpot/penpot"
|
|
},
|
|
"type": "module",
|
|
"scripts": {
|
|
"lint": "./scripts/lint",
|
|
"check-fmt": "./scripts/check-fmt",
|
|
"fmt": "./scripts/fmt"
|
|
},
|
|
"devDependencies": {
|
|
"@github/copilot": "^1.0.43",
|
|
"@types/node": "^25.6.0",
|
|
"esbuild": "^0.28.0",
|
|
"opencode-ai": "^1.14.40"
|
|
}
|
|
}
|