CodeCow/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2026-07-15 21:03:26 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
78b018989e
zulip/zerver/lib
History
Anders Kaseorg 780ecb672b CVE-2019-16216: Fix MIME type validation. 
* Whitelist a small number of image/ types to be served as
  non-attachments.
* Serve the file using the type that we validated rather than relying
  on an independent guess to match.

This issue can lead to a stored XSS security vulnerability for older
browsers that don't support Content-Security-Policy.

It primarily affects servers using Zulip's local file uploads backend
for servers running Ubuntu 16.04 Xenial or newer; the legacy local
file upload backend for (now EOL) Ubuntu 14.04 Trusty was not affected
and it has limited impact for the S3 upload backend (which uses an
unprivileged S3 bucket domain to serve files).

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2019-09-11 15:46:36 -07:00
..
bugdown markdown: Render ordered lists using <ol> markup. 2019-09-08 16:42:20 -07:00
url_preview url preview: Rename type_ variable to oembed_resource_type. 2019-06-02 14:31:39 -07:00
webhooks webhooks: Log unexpected webhook events separately. 2019-07-22 18:20:53 -07:00
__init__.py [manual] Rename Django app from zephyr to zerver. 2013-08-06 07:39:36 -04:00
actions.py actions: Remove leftover print statement. 2019-09-08 15:36:30 -07:00
addressee.py addressee: Clean up type ignores. 2019-08-09 16:39:16 -07:00
alert_words.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
attachments.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
avatar_hash.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
avatar.py ldap: Fix LDAP avatar synchronization to check if avatar has changed. 2019-07-02 17:52:48 -07:00
bot_config.py mypy: Remove type ignores for python 3 stubs now present in typeshed. 2019-08-06 23:24:56 -07:00
bot_lib.py streams: Refactor multi-option helpers into separate functions. 2019-02-12 11:10:26 -08:00
bot_storage.py python: Stop importing Length from the wrong file. 2019-02-02 17:09:10 -08:00
bulk_create.py stream-descriptions: Create wrapper for rendering stream descriptions. 2019-03-06 17:16:14 -08:00
cache_helpers.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
cache.py messages: Don't use display_recipient values from cached message_dicts. 2019-08-20 12:15:30 -07:00
camo.py camo: Clean up type ignores. 2019-08-09 16:39:16 -07:00
ccache.py str_utils: Move force_bytes into ccache.py. 2018-05-15 19:07:32 -07:00
context_managers.py zerver/lib: Use python 3 syntax for typing. 2017-11-21 20:45:52 -08:00
create_user.py settings: Add FAKE_EMAIL_DOMAIN setting. 2019-08-30 14:59:00 -07:00
db.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
debug.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
dev_ldap_directory.py settings: Unset STATIC_ROOT in development. 2019-07-24 17:40:31 -07:00
digest.py emails: Show preheader block only if preheader is present. 2019-08-17 11:32:28 -07:00
display_recipient.py display_recipient: Deduplicate list of display_recipient fields. 2019-08-20 12:22:37 -07:00
domains.py domains: Fix typing for validate_domain. 2019-07-29 15:18:24 -07:00
email_mirror_helpers.py stream settings: Use the .show-sender version of email address. 2019-09-05 11:48:32 -07:00
email_mirror.py email_mirror: Rename include-quotations to include-quotes. 2019-07-20 15:53:43 -07:00
email_notifications.py messages: Add email/push notifications for wildcard mentions. 2019-08-26 14:39:53 -07:00
emoji.py emoji: Clean up type ignores. 2019-08-09 16:39:16 -07:00
error_notify.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
events.py page_params: Send the list of config_options for incoming webhook bots. 2019-08-20 17:00:48 -07:00
exceptions.py mypy: Migrate from mypy_extensions to typing_extensions. 2019-08-05 17:24:09 -07:00
export.py exports: Refactor extra_data to export_data. 2019-08-12 17:51:46 -07:00
external_accounts.py custom fields: Add default external account custom fields. 2019-08-28 15:35:53 -07:00
feedback.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
fix_unreads.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
generate_test_data.py test-backend: Move test_messages.json to var/<uuid>/test-backend. 2019-06-24 12:23:09 -07:00
hotspots.py docs: Mention bug in ALWAYS_SEND_ALL_HOTSPOTS feature. 2019-02-27 10:21:30 -08:00
html_diff.py mypy: Remove type: ignores that are unnecessary with new mypy. 2017-11-25 10:06:28 -08:00
html_to_text.py html_to_text: Add delimiters between text from different elements. 2019-05-01 17:35:20 -07:00
i18n.py i18n: Move static/locale back to locale. 2019-07-02 14:57:55 -07:00
import_realm.py import: Fix importing slack avatars into S3_UPLOAD_BACKEND. 2019-07-21 21:25:31 -07:00
initial_password.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
integrations.py bots: Specify config options for an incoming webhook integration. 2019-08-20 16:44:56 -07:00
json_encoder_for_html.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
logging_util.py errors: Fix infinite recursion during memcached outages. 2019-09-03 11:44:39 -07:00
management.py management: Fix password reset emails being sent to deactivated users. 2019-08-14 10:50:45 -07:00
mdiff.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
mention.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
message.py messages: Fix unread_msgs accounting of wildcard mentions. 2019-08-25 20:32:12 -07:00
migrate.py migrate, create_large_indexes: Use CREATE INDEX IF NOT EXISTS. 2019-06-26 11:01:30 -07:00
mobile_auth_otp.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
name_restrictions.py signup: Add opayq.com to disposable domain whitelist. 2018-08-13 10:56:47 -07:00
narrow.py search: Add streams:public to search entire history of public streams. 2019-08-22 13:40:49 -07:00
onboarding.py api: Use new endpoint for handling reactions. 2019-08-16 14:36:15 -07:00
openapi.py openapi: Fix handling of parameters passed via the URL/path. 2019-08-19 15:06:08 -07:00
outgoing_webhook.py lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
parallel.py zerver/lib: Use python 3 syntax for typing. 2017-11-18 16:09:04 -08:00
profile.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
push_notifications.py markdown: Render ordered lists using <ol> markup. 2019-09-08 16:42:20 -07:00
queue.py requirements: Upgrade mypy to 0.711. 2019-07-22 17:12:50 -07:00
rate_limiter.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
realm_description.py html_to_text: Add delimiters between text from different elements. 2019-05-01 17:35:20 -07:00
realm_icon.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
realm_logo.py realm_logo: Remove redundant realm_logo_url function. 2019-08-20 12:07:20 -07:00
redis_utils.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
remote_server.py analytics: Fix logging for errors connecting to push bouncer. 2019-09-02 18:47:10 -07:00
request.py request: Fix other syntax error on Xenial Python. 2019-08-19 15:58:12 -07:00
response.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
rest.py zerver: Accept HEAD requests wherever GET requests are accepted. 2019-08-12 16:47:41 -07:00
retention.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
send_email.py email: Convert send_email to use formataddr. 2019-07-22 18:15:58 -07:00
sessions.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
soft_deactivation.py soft deactivation: Remove useless conditional. 2019-05-08 14:40:33 -07:00
sqlalchemy_utils.py mypy: Set local_partial_types = True. 2018-05-21 22:41:00 -07:00
statistics.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
storage.py storage: Stop using django-pipeline. 2019-07-24 17:40:31 -07:00
stream_recipient.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
stream_subscription.py mypy: Migrate from mypy_extensions to typing_extensions. 2019-08-05 17:24:09 -07:00
stream_topic.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
streams.py search: Add streams:public to search entire history of public streams. 2019-08-22 13:40:49 -07:00
subdomains.py get_realm: raise DoesNotExist instead of returning None. 2019-05-06 21:58:16 -07:00
test_classes.py test_classes: Use subdomain kwarg in api_* functions instead of realm. 2019-07-23 15:05:39 -07:00
test_data.source.txt test_data.source.txt: Replace postmodernism generator text with a play. 2017-08-23 13:00:39 -07:00
test_fixtures.py test_fixtures: Add logic for removing stale test directories. 2019-07-12 17:42:18 -07:00
test_helpers.py test_helpers: Refactor dummy file creation for broader use. 2019-08-07 12:05:44 -07:00
test_runner.py test_runner: Clean up type ignores. 2019-08-09 16:39:16 -07:00
tex.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
thumbnail.py camo: Add endpoint to handle camo requests. 2019-01-04 10:27:04 -08:00
timeout.py mypy: Add assertion in timeout.py. 2018-04-25 08:58:55 -07:00
timestamp.py zerver/lib: Use python 3 syntax for typing. 2017-11-18 16:09:04 -08:00
timezone.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
topic_mutes.py Extract topic_match_sa() helper. 2018-11-07 10:03:53 -08:00
topic.py topic: Clean up type ignores. 2019-08-09 17:42:33 -07:00
transfer.py python: Remove unused imports. 2019-02-22 16:54:36 -08:00
type_debug.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
types.py types: Consistently use DisplayRecipientT for display_recipient objects. 2019-08-20 12:15:30 -07:00
unminify.py cleanup: Delete leading newlines. 2019-08-06 23:29:11 -07:00
upload.py CVE-2019-16216: Fix MIME type validation. 2019-09-11 15:46:36 -07:00
url_encoding.py topic -> subject: Extract get_topic_from_message_info(). 2018-11-14 23:24:06 -08:00
user_agent.py user_agent: Use re.X to make the regex a little more readable. 2018-12-05 14:58:13 -08:00
user_groups.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
user_status.py user status: Add "status_text" support in the backend. 2019-01-24 09:46:35 -08:00
users.py bots: Allow incoming webhook bots to be configured via /bots. 2019-08-20 17:00:48 -07:00
utils.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
validator.py custom profile: Rename check_url_pattern. 2019-08-05 20:59:47 -07:00
video_calls.py zoom: Fix handling of 201 status codes from zoom API. 2019-01-16 15:37:06 -08:00
widget.py zerver core: Remove unused imports. 2019-02-02 17:41:24 -08:00
zcommand.py zcommand: Fix broken switch mode message. 2018-08-08 11:29:49 -07:00
zephyr.py python: Remove now-unnecessary str_utils library. 2018-11-27 11:57:54 -08:00