zulip/zerver/lib
Anders Kaseorg 780ecb672b CVE-2019-16216: Fix MIME type validation.
* Whitelist a small number of image/ types to be served as
  non-attachments.
* Serve the file using the type that we validated rather than relying
  on an independent guess to match.

This issue can lead to a stored XSS security vulnerability for older
browsers that don't support Content-Security-Policy.

It primarily affects servers using Zulip's local file uploads backend
for servers running Ubuntu 16.04 Xenial or newer; the legacy local
file upload backend for (now EOL) Ubuntu 14.04 Trusty was not affected
and it has limited impact for the S3 upload backend (which uses an
unprivileged S3 bucket domain to serve files).

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-09-11 15:46:36 -07:00
..
bugdown markdown: Render ordered lists using <ol> markup. 2019-09-08 16:42:20 -07:00
url_preview url preview: Rename type_ variable to oembed_resource_type. 2019-06-02 14:31:39 -07:00
webhooks webhooks: Log unexpected webhook events separately. 2019-07-22 18:20:53 -07:00
__init__.py
actions.py actions: Remove leftover print statement. 2019-09-08 15:36:30 -07:00
addressee.py addressee: Clean up type ignores. 2019-08-09 16:39:16 -07:00
alert_words.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
attachments.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
avatar.py ldap: Fix LDAP avatar synchronization to check if avatar has changed. 2019-07-02 17:52:48 -07:00
avatar_hash.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
bot_config.py mypy: Remove type ignores for python 3 stubs now present in typeshed. 2019-08-06 23:24:56 -07:00
bot_lib.py
bot_storage.py
bulk_create.py stream-descriptions: Create wrapper for rendering stream descriptions. 2019-03-06 17:16:14 -08:00
cache.py messages: Don't use display_recipient values from cached message_dicts. 2019-08-20 12:15:30 -07:00
cache_helpers.py
camo.py camo: Clean up type ignores. 2019-08-09 16:39:16 -07:00
ccache.py
context_managers.py
create_user.py settings: Add FAKE_EMAIL_DOMAIN setting. 2019-08-30 14:59:00 -07:00
db.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
debug.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
dev_ldap_directory.py settings: Unset STATIC_ROOT in development. 2019-07-24 17:40:31 -07:00
digest.py emails: Show preheader block only if preheader is present. 2019-08-17 11:32:28 -07:00
display_recipient.py display_recipient: Deduplicate list of display_recipient fields. 2019-08-20 12:22:37 -07:00
domains.py domains: Fix typing for validate_domain. 2019-07-29 15:18:24 -07:00
email_mirror.py email_mirror: Rename include-quotations to include-quotes. 2019-07-20 15:53:43 -07:00
email_mirror_helpers.py stream settings: Use the .show-sender version of email address. 2019-09-05 11:48:32 -07:00
email_notifications.py messages: Add email/push notifications for wildcard mentions. 2019-08-26 14:39:53 -07:00
emoji.py emoji: Clean up type ignores. 2019-08-09 16:39:16 -07:00
error_notify.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
events.py page_params: Send the list of config_options for incoming webhook bots. 2019-08-20 17:00:48 -07:00
exceptions.py mypy: Migrate from mypy_extensions to typing_extensions. 2019-08-05 17:24:09 -07:00
export.py exports: Refactor extra_data to export_data. 2019-08-12 17:51:46 -07:00
external_accounts.py custom fields: Add default external account custom fields. 2019-08-28 15:35:53 -07:00
feedback.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
fix_unreads.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
generate_test_data.py test-backend: Move `test_messages.json` to `var/<uuid>/test-backend`. 2019-06-24 12:23:09 -07:00
hotspots.py
html_diff.py
html_to_text.py html_to_text: Add delimiters between text from different elements. 2019-05-01 17:35:20 -07:00
i18n.py i18n: Move static/locale back to locale. 2019-07-02 14:57:55 -07:00
import_realm.py import: Fix importing slack avatars into S3_UPLOAD_BACKEND. 2019-07-21 21:25:31 -07:00
initial_password.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
integrations.py bots: Specify config options for an incoming webhook integration. 2019-08-20 16:44:56 -07:00
json_encoder_for_html.py
logging_util.py errors: Fix infinite recursion during memcached outages. 2019-09-03 11:44:39 -07:00
management.py management: Fix password reset emails being sent to deactivated users. 2019-08-14 10:50:45 -07:00
mdiff.py
mention.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
message.py messages: Fix unread_msgs accounting of wildcard mentions. 2019-08-25 20:32:12 -07:00
migrate.py migrate, create_large_indexes: Use CREATE INDEX IF NOT EXISTS. 2019-06-26 11:01:30 -07:00
mobile_auth_otp.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
name_restrictions.py
narrow.py search: Add streams:public to search entire history of public streams. 2019-08-22 13:40:49 -07:00
onboarding.py api: Use new endpoint for handling reactions. 2019-08-16 14:36:15 -07:00
openapi.py openapi: Fix handling of parameters passed via the URL/path. 2019-08-19 15:06:08 -07:00
outgoing_webhook.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
parallel.py
profile.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
push_notifications.py markdown: Render ordered lists using <ol> markup. 2019-09-08 16:42:20 -07:00
queue.py requirements: Upgrade mypy to 0.711. 2019-07-22 17:12:50 -07:00
rate_limiter.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
realm_description.py html_to_text: Add delimiters between text from different elements. 2019-05-01 17:35:20 -07:00
realm_icon.py
realm_logo.py realm_logo: Remove redundant `realm_logo_url` function. 2019-08-20 12:07:20 -07:00
redis_utils.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
remote_server.py analytics: Fix logging for errors connecting to push bouncer. 2019-09-02 18:47:10 -07:00
request.py request: Fix other syntax error on Xenial Python. 2019-08-19 15:58:12 -07:00
response.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
rest.py zerver: Accept HEAD requests wherever GET requests are accepted. 2019-08-12 16:47:41 -07:00
retention.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
send_email.py email: Convert send_email to use formataddr. 2019-07-22 18:15:58 -07:00
sessions.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
soft_deactivation.py soft deactivation: Remove useless conditional. 2019-05-08 14:40:33 -07:00
sqlalchemy_utils.py
statistics.py
storage.py storage: Stop using django-pipeline. 2019-07-24 17:40:31 -07:00
stream_recipient.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
stream_subscription.py mypy: Migrate from mypy_extensions to typing_extensions. 2019-08-05 17:24:09 -07:00
stream_topic.py
streams.py search: Add streams:public to search entire history of public streams. 2019-08-22 13:40:49 -07:00
subdomains.py get_realm: raise DoesNotExist instead of returning None. 2019-05-06 21:58:16 -07:00
test_classes.py test_classes: Use subdomain kwarg in api_* functions instead of realm. 2019-07-23 15:05:39 -07:00
test_data.source.txt
test_fixtures.py test_fixtures: Add logic for removing stale test directories. 2019-07-12 17:42:18 -07:00
test_helpers.py test_helpers: Refactor dummy file creation for broader use. 2019-08-07 12:05:44 -07:00
test_runner.py test_runner: Clean up type ignores. 2019-08-09 16:39:16 -07:00
tex.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
thumbnail.py
timeout.py
timestamp.py
timezone.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
topic.py topic: Clean up type ignores. 2019-08-09 17:42:33 -07:00
topic_mutes.py
transfer.py
type_debug.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
types.py types: Consistently use DisplayRecipientT for display_recipient objects. 2019-08-20 12:15:30 -07:00
unminify.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
upload.py CVE-2019-16216: Fix MIME type validation. 2019-09-11 15:46:36 -07:00
url_encoding.py
user_agent.py
user_groups.py
user_status.py
users.py bots: Allow incoming webhook bots to be configured via /bots. 2019-08-20 17:00:48 -07:00
utils.py
validator.py custom profile: Rename check_url_pattern. 2019-08-05 20:59:47 -07:00
video_calls.py
widget.py
zcommand.py
zephyr.py