Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/zerver/lib
History
Tim Abbott 4901dc3795 url_preview: Fix parsing of open graph tags. 
Our open graph parser logic sloppily mixed data obtained by parsing
open graph properties with trusted data set by our oembed parser.

We fix this by consistenly using our explicit whitelist of generic
properties (image, title, and description) in both places where we
interact with open graph properties.  The fixes are redundant with
each other, but doing both helps in making the intent of the code
clearer.

This issue fixed here was originally reported as an XSS vulnerability
in the upcoming Inline URL Previews feature found by Graham Bleaney
and Ibrahim Mohamed using Pysa.  The recent Oembed changes close that
vulnerability, but this change is still worth doing to make the
implementation do what it looks like it does.
 		2019-12-12 15:24:38 -08:00
..
bugdown messages: Set has_attachment correctly using Bugdown. 2019-12-11 11:03:44 -08:00
url_preview url_preview: Fix parsing of open graph tags. 2019-12-12 15:24:38 -08:00
webhooks webhooks: Log unexpected webhook events separately. 2019-07-22 18:20:53 -07:00
__init__.py
…
actions.py models: Use unlimited .select_related() for Stream and DefaultStream. 2019-12-12 12:13:07 -08:00
addressee.py addressee: Clean up type ignores. 2019-08-09 16:39:16 -07:00
alert_words.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
attachments.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
avatar.py avatars: Fix gravatar URLs with EMAIL_ADDRESS_VISIBILITY_ADMINS. 2019-11-05 12:33:20 -08:00
avatar_hash.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
bot_config.py mypy: Remove type ignores for python 3 stubs now present in typeshed. 2019-08-06 23:24:56 -07:00
bot_lib.py streams: Refactor multi-option helpers into separate functions. 2019-02-12 11:10:26 -08:00
bot_storage.py python: Stop importing Length from the wrong file. 2019-02-02 17:09:10 -08:00
bulk_create.py models: Add recipient foreign key in UserProfile and Stream. 2019-12-09 15:14:41 -08:00
cache.py users: Refactor get_members_backend endpoint to use get_raw_user_data. 2019-10-23 14:50:26 -07:00
cache_helpers.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
camo.py camo: Clean up type ignores. 2019-08-09 16:39:16 -07:00
ccache.py
…
context_managers.py
…
create_user.py models: Add recipient foreign key in UserProfile and Stream. 2019-12-09 15:14:41 -08:00
db.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
debug.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
dev_ldap_directory.py ldap: Fix development environment configuration. 2019-11-08 14:00:24 -08:00
digest.py digest: Switch from emails to user IDs for logging. 2019-11-15 17:07:52 -08:00
display_recipient.py display_recipient: Deduplicate list of display_recipient fields. 2019-08-20 12:22:37 -07:00
domains.py domains: Fix typing for validate_domain. 2019-07-29 15:18:24 -07:00
email_mirror.py users: Eliminate some unnecessary get_personal_recipient calls. 2019-12-09 15:24:35 -08:00
email_mirror_helpers.py stream settings: Use the .show-sender version of email address. 2019-09-05 11:48:32 -07:00
email_notifications.py onboarding: Fix welcome emails not using delivery_email. 2019-11-15 16:49:28 -08:00
emoji.py decorator: Extract OrganizationAdministratorRequired common exception. 2019-11-18 15:10:56 -08:00
error_notify.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
events.py pm_conversations: Initialize using server data. 2019-11-21 17:01:41 -08:00
exceptions.py decorator: Extract OrganizationAdministratorRequired common exception. 2019-11-18 15:10:56 -08:00
export.py models: Migration of Message.pub_date to date_sent, part 2. 2019-10-05 19:01:34 -07:00
external_accounts.py custom fields: Add default external account custom fields. 2019-08-28 15:35:53 -07:00
feedback.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
fix_unreads.py logging: Switch various logging code paths to use user IDs. 2019-11-15 17:24:01 -08:00
generate_test_data.py test-backend: Move `test_messages.json` to `var/<uuid>/test-backend`. 2019-06-24 12:23:09 -07:00
hotspots.py docs: Mention bug in ALWAYS_SEND_ALL_HOTSPOTS feature. 2019-02-27 10:21:30 -08:00
html_diff.py
…
html_to_text.py html_to_text: Add delimiters between text from different elements. 2019-05-01 17:35:20 -07:00
i18n.py i18n: Move static/locale back to locale. 2019-07-02 14:57:55 -07:00
import_realm.py models: Add recipient foreign key in UserProfile and Stream. 2019-12-09 15:14:41 -08:00
initial_password.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
integrations.py integrations: Add Gitea integration. 2019-11-18 11:55:24 -08:00
logging_util.py settings: Define logging paths with, like, normal human variables. 2019-11-13 12:38:35 -08:00
management.py management: Fix password reset emails being sent to deactivated users. 2019-08-14 10:50:45 -07:00
mdiff.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
mention.py bugdown: Store if message has wildcards in MentionData. 2019-12-02 12:12:35 -08:00
message.py messages: Optimize get_recent_private_conversations. 2019-12-09 15:23:10 -08:00
migrate.py migrate, create_large_indexes: Use CREATE INDEX IF NOT EXISTS. 2019-06-26 11:01:30 -07:00
mobile_auth_otp.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
name_restrictions.py signup: Add opayq.com to disposable domain whitelist. 2018-08-13 10:56:47 -07:00
narrow.py search: Add streams:public to search entire history of public streams. 2019-08-22 13:40:49 -07:00
onboarding.py api: Use new endpoint for handling reactions. 2019-08-16 14:36:15 -07:00
openapi.py openapi: Fix handling of parameters passed via the URL/path. 2019-08-19 15:06:08 -07:00
outgoing_webhook.py mypy: Upgrade from 0.730 to 0.740. 2019-11-13 12:38:45 -08:00
parallel.py
…
profile.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
push_notifications.py push_notifs: Improve handling of errors when talking to the bouncer. 2019-12-04 09:58:22 -08:00
queue.py queue: Update error callback signatures for Pika 1.1. 2019-11-20 17:23:48 -08:00
rate_limiter.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
realm_description.py html_to_text: Add delimiters between text from different elements. 2019-05-01 17:35:20 -07:00
realm_icon.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
realm_logo.py realm_logo: Remove redundant `realm_logo_url` function. 2019-08-20 12:07:20 -07:00
redis_utils.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
remote_server.py push_notifs: Handle more requests Exceptions in send_to_push_bouncer. 2019-12-04 09:58:22 -08:00
request.py request: Tighten type checking on REQ. 2019-11-13 12:35:55 -08:00
response.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
rest.py upload: Fix browser caching of uploads with local uploads backend. 2019-10-01 15:15:17 -07:00
retention.py streams: Remove get_stream_recipients function and its uses. 2019-12-12 12:05:42 -08:00
send_email.py email: Convert send_email to use formataddr. 2019-07-22 18:15:58 -07:00
sessions.py logging: Switch various logging code paths to use user IDs. 2019-11-15 17:24:01 -08:00
soft_deactivation.py soft_deactivation: Remove 'email' from logging. 2019-11-15 17:06:51 -08:00
sqlalchemy_utils.py
…
statistics.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
storage.py docs: Merge front-end-build-process with html-css. 2019-10-23 13:08:36 -07:00
stream_recipient.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
stream_subscription.py mypy: Migrate from mypy_extensions to typing_extensions. 2019-08-05 17:24:09 -07:00
stream_topic.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
streams.py recipients: Remove bulk_get_recipients function and its uses. 2019-12-12 12:00:13 -08:00
subdomains.py get_realm: raise DoesNotExist instead of returning None. 2019-05-06 21:58:16 -07:00
test_classes.py models: Add recipient foreign key in UserProfile and Stream. 2019-12-09 15:14:41 -08:00
test_data.source.txt
…
test_fixtures.py notifications: Enable online push notifications by default. 2019-12-12 13:04:10 -08:00
test_helpers.py test_helpers: Refactor dummy file creation for broader use. 2019-08-07 12:05:44 -07:00
test_runner.py test_runner: Clean up type ignores. 2019-08-09 16:39:16 -07:00
tex.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
thumbnail.py camo: Add endpoint to handle camo requests. 2019-01-04 10:27:04 -08:00
timeout.py
…
timestamp.py
…
timezone.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
topic.py bugdown: Correctly set has_link attribute on messages. 2019-12-11 17:01:41 +05:30
topic_mutes.py Extract topic_match_sa() helper. 2018-11-07 10:03:53 -08:00
transfer.py logging: Switch various logging code paths to use user IDs. 2019-11-15 17:24:01 -08:00
type_debug.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
types.py types: Consistently use DisplayRecipientT for display_recipient objects. 2019-08-20 12:15:30 -07:00
unminify.py unminify: Update for webpack chunk splitting. 2019-11-01 18:25:30 -07:00
upload.py messages: Remove dependence on regex for claiming attachments. 2019-12-11 11:03:49 -08:00
url_encoding.py topic -> subject: Extract get_topic_from_message_info(). 2018-11-14 23:24:06 -08:00
user_agent.py user_agent: Use re.X to make the regex a little more readable. 2018-12-05 14:58:13 -08:00
user_groups.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
user_status.py user status: Add "status_text" support in the backend. 2019-01-24 09:46:35 -08:00
users.py decorator: Extract OrganizationAdministratorRequired common exception. 2019-11-18 15:10:56 -08:00
utils.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
validator.py validators: Add check_int_in validator. 2019-11-18 15:14:56 -08:00
video_calls.py zoom: Fix handling of 201 status codes from zoom API. 2019-01-16 15:37:06 -08:00
widget.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
zcommand.py zcommand: Fix broken switch mode message. 2018-08-08 11:29:49 -07:00
zephyr.py python: Remove now-unnecessary str_utils library. 2018-11-27 11:57:54 -08:00