summaryrefslogtreecommitdiff
path: root/packages/backend/src/core/UtilityService.ts (follow)
Commit message (Collapse)AuthorAgeFilesLines
* split url into webUrl and localUrl (like mastodon)stableFreya Murphy30 hours1-3/+5
|
* allow HTTP connections to private IPsHazelnoot2025-07-271-4/+4
|
* refactor actor validation to reduce code duplicationHazelnoot2025-07-271-2/+2
|
* validate all URLs before fetchHazelnoot2025-07-271-3/+56
|
* fix bad merge in UtilityService.tsHazelnoot2025-06-011-9/+0
|
* merge: Instance admin UX improvements (!1059)Hazelnoot2025-06-011-0/+9
|\ | | | | | | | | | | View MR for information: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/1059 Approved-by: dakkar <dakkar@thenautilus.net> Approved-by: Marie <github@yuugi.dev>
| * disable status badge strip in admin-user and instance-infoHazelnoot2025-05-291-0/+9
| |
* | add utility service overloads for quickly checking hosts against meta valuesHazelnoot2025-05-281-6/+33
|/
* validate more URLs in UrlPreviewService.tsHazelnoot2025-05-081-0/+10
|
* Merge branch 'develop' into merge/2025-03-24Hazelnoot2025-05-061-2/+11
|\
| * make `toPuny` work better in testingdakkar2025-04-211-2/+11
| |
* | replace email validation regex with a simpler alternativeHazelnoot2025-04-011-1/+3
| |
* | merge upstreamHazelnoot2025-03-251-0/+8
|\ \ | |/ |/|
| * fix(backend): ↵鴇峰 朔華2025-02-161-0/+8
| | | | | | | | | | | | | | | | | | | | | | メールアドレスの形式が正しくなければ以降の処理を行わないように (#15320) * Mod: バリデーションを追加 * 条件の修正 notつけわすれ * Update CHANGELOG.md
* | merge upstream 2025-02-03Hazelnoot2025-02-031-4/+3
|\|
| * fix: node.js の punycode ↵anatawa122025-01-141-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | モジュールが使用されている場所がある問題 (#15248) * fix: punycode.js が使用されていない場所がある問題 * fix: use punycode/punycode.js on backend * fix: use punycode/punycode.es6.js on backend * fix: d.ts missing declare keyword * chore: don't use punycode.js on backend * update pnpm-lock.yaml * chore: remove punycode.d.ts * chore: use punycode.js instead of punycode npm package * chore: bump psl to 1.15.0 * chore: bump nsfwjs to 4.2.0 4.2.1 is not usable because of https://github.com/infinitered/nsfwjs/issues/904 * chore: prevent loading node-fetch from tensorflow * chore: DOMWindow['document'] => Document IDK why DOMWindow['document'] fails, but might be related to tsc internal complexity limit * fix: disable --trace-deprecation --------- Co-authored-by: syuilo <4439005+syuilo@users.noreply.github.com>
* | Merge branch 'develop' into feature/2024.10dakkar2024-12-051-3/+25
|\ \
| * | handle `.masto.host` speciallydakkar2024-11-291-1/+13
| | |
| * | actually use the correct `import` syntaxdakkar2024-11-291-1/+1
| | | | | | | | | | | | CenTdemeern1 had told me, but I got it wrong ☹
| * | use "userland" `punycode`, plus testsdakkar2024-11-291-3/+3
| | | | | | | | | | | | thanks to CenTdemeern1 for the `import` incantation
| * | UNTESTED maybe laxer match on authority - fixes #815dakkar2024-11-291-0/+9
| | |
* | | Merge tag '2024.11.0' into feature/2024.10dakkar2024-11-221-0/+1
|\ \ \ | |/ / |/| / | |/
| * Merge commit from forkJulia2024-11-211-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * enhance: Add a few validation fixes from Sharkey See the original MR on the GitLab instance: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/484 Co-Authored-By: Dakkar <dakkar@thenautilus.net> * fix: primitive 2: acceptance of cross-origin alternate Co-Authored-By: Laura Hausmann <laura@hausmann.dev> * fix: primitive 3: validation of non-final url * fix: primitive 4: missing same-origin identifier validation of collection-wrapped activities * fix: primitives 5 & 8: reject activities with non string identifiers Co-Authored-By: Laura Hausmann <laura@hausmann.dev> * fix: primitive 6: reject anonymous objects that were fetched by their id * fix: primitives 9, 10 & 11: http signature validation doesn't enforce required headers or specify auth header name Co-Authored-By: Laura Hausmann <laura@hausmann.dev> * fix: primitive 14: improper validation of outbox, followers, following & shared inbox collections * fix: code style for primitive 14 * fix: primitive 15: improper same-origin validation for note uri and url Co-Authored-By: Laura Hausmann <laura@hausmann.dev> * fix: primitive 16: improper same-origin validation for user uri and url * fix: primitive 17: note same-origin identifier validation can be bypassed by wrapping the id in an array * fix: code style for primitive 17 * fix: check attribution against actor in notes While this isn't strictly required to fix the exploits at hand, this mirrors the fix in `ApQuestionService` for GHSA-5h8r-gq97-xv69, as a preemptive countermeasure. * fix: primitive 18: `ap/get` bypasses access checks One might argue that we could make this one actually preform access checks against the returned activity object, but I feel like that's a lot more work than just restricting it to administrators, since, to me at least, it seems more like a debugging tool than anything else. * fix: primitive 19 & 20: respect blocks and hide more Ideally, the user property should also be hidden (as leaving it in leaks information slightly), but given the schema of the note endpoint, I don't think that would be possible without introducing some kind of "ghost" user, who is attributed for posts by users who have you blocked. * fix: primitives 21, 22, and 23: reuse resolver This also increases the default `recursionLimit` for `Resolver`, as it theoretically will go higher that it previously would and could possibly fail on non-malicious collection activities. * fix: primitives 25-33: proper local instance checks * revert: fix: primitive 19 & 20 This reverts commit 465a9fe6591de90f78bd3d084e3c01e65dc3cf3c. --------- Co-authored-by: Dakkar <dakkar@thenautilus.net> Co-authored-by: Laura Hausmann <laura@hausmann.dev> Co-authored-by: syuilo <4439005+syuilo@users.noreply.github.com>
* | fix: primitives 25-33: proper local instance checksJulia Johannesen2024-11-201-0/+5
| |
* | Merge remote-tracking branch 'misskey/master' into feature/2024.9.0dakkar2024-10-091-0/+18
|\|
| * wip (#14643)syuilo2024-09-281-0/+19
| |
* | make "media silenced" work like "silenced"dakkar2024-08-061-1/+1
| | | | | | | | that is, silencing `foo.com` also silences `sub.foo.com`
* | Merge remote-tracking branch 'misskey/master' into feature/misskey-2024.07dakkar2024-08-021-0/+6
|\|
| * feat: media silence (#13842)anatawa122024-07-301-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * feat: media silence * fix: lint * feat: deny creating custom emoji reaction and using custom emoji from media silenced hosts * chore: メディアサイレンスの説明にカスタム絵文字の話を追加 * Update locales/ja-JP.yml Co-authored-by: Sayamame-beans <61457993+Sayamame-beans@users.noreply.github.com> * chore: update index.d.ts * docs(changelog): update changelog --------- Co-authored-by: Sayamame-beans <61457993+Sayamame-beans@users.noreply.github.com>
| * enhance: 禁止ワードチェック強化 (#27)tamaina2024-03-011-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * enhance: 禁止ワードチェック強化 * リモートの禁止ワードチェックを添付ファイルとユーザーを登録する前に行うなど Resolve https://github.com/misskey-dev/misskey/issues/13374 * 禁止ワートの対象の見直し * performActivityで特定のエラーが出た際にDelayedに追加しないように * use IdentifiableError * NoteCreateService.checkProhibitedWords * https://github.com/misskey-dev/misskey-private/pull/27/files#r1507416135 * remove comment
* | some validation fixesdakkar2024-03-301-1/+8
| |
* | merge upstream for 2024.2.1dakkar2024-03-021-0/+14
|/
* (re) update SPDX-FileCopyrightTexttamaina2024-02-131-1/+1
| | | | Fix #13290
* Revert "update SPDX-FileCopyrightText"tamaina2024-02-131-1/+1
| | | | This reverts commit 9b5aeb76d8c9372d67058c512597152b6bf222f2.
* update SPDX-FileCopyrightTextsyuilo2024-02-121-1/+1
|
* fix: ↵おさむのひと2024-02-091-3/+3
| | | | | | | 特定文字列を含むノートを投稿できないようにする管理画面用設定項目を追加 (#13210) * fix: 特定文字列を含むノートを投稿できないようにする管理画面用設定項目を追加 * Serviceでチェックするように変更
* enhance(backend): ↵syuilo2023-12-241-0/+28
| | | | センシティブワードの設定がハッシュタグトレンドにも適用されるように
* feat: サーバーサイレンス機能を追加 (#12031)まっちゃてぃー2023-10-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * feat : サーバーサイレンスを追加 * Update CHANGELOG.md * Update CHANGELOG.md * Update locale * Update instance-info.vue * update misskey-js.api.md * lint fix * migration fix * 既存のものを使うように * fix * 色々直した * Update packages/frontend/src/pages/admin/instance-block.vue * Update packages/frontend/src/pages/admin/instance-block.vue * Update packages/frontend/src/components/MkInstanceCardMini.vue * Update packages/backend/src/core/entities/InstanceEntityService.ts * Update packages/backend/src/core/entities/InstanceEntityService.ts * Update packages/backend/src/core/entities/InstanceEntityService.ts * Update packages/backend/src/core/UserFollowingService.ts * Update packages/backend/src/core/UserFollowingService.ts * fix: サイレンスされてるサーバーからの投稿は全部ホームにする * fix: undefinedでfalseを返すようにした --------- Co-authored-by: syuilo <Syuilotan@yahoo.co.jp>
* chore: ↵Shun Sakai2023-07-271-0/+5
| | | | | | | | | | | | | | 著作権とライセンスについての情報を各ファイルに追加する (#11348) * chore: Add the SPDX information to each file Add copyright and licensing information as defined in version 3.0 of the REUSE Specification. * tweak format --------- Co-authored-by: syuilo <Syuilotan@yahoo.co.jp>
* enhance: Judge instance block by endsWith (#9263)tamaina2023-01-131-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * TypeScriptでendsWith * fix * SQL? * バ〜カアホ * Update packages/backend/src/core/UtilityService.ts Co-authored-by: Acid Chicken (硫酸鶏) <root@acid-chicken.com> * add comment * add description * Update packages/backend/src/core/UtilityService.ts Co-authored-by: syuilo <Syuilotan@yahoo.co.jp> * Update packages/backend/src/core/chart/charts/federation.ts Co-authored-by: Acid Chicken (硫酸鶏) <root@acid-chicken.com> * remove comment * fix * fix? * add changelog * ILIKE, ARRAY Co-authored-by: Acid Chicken (硫酸鶏) <root@acid-chicken.com> Co-authored-by: syuilo <Syuilotan@yahoo.co.jp>
* refactor: introduce bindThis decorator to bind this automaticalysyuilo2022-12-041-0/+6
|
* fix import typesyuilo2022-09-211-1/+1
|
* なんかもうめっちゃ変えたsyuilo2022-09-181-0/+37
generated by cgit v1.2.3-freya (git 2.53.0.84.g453e7b744a) at 2026-03-04 06:08:44 +0000