Merge branch 'release/2.5.3' into 'stable'

Release 2.5.3

See merge request pleroma/pleroma!3926
This commit is contained in:
Haelwenn 2023-08-04 09:45:48 +00:00
commit ff2f3862ab
12 changed files with 65 additions and 6 deletions

View File

@ -32,7 +32,13 @@ before_script:
after_script: after_script:
- rm -rf _build/*/lib/pleroma - rm -rf _build/*/lib/pleroma
.using-ci-base:
tags:
- amd64
build: build:
extends:
- .using-ci-base
stage: build stage: build
only: only:
changes: &build_changes_policy changes: &build_changes_policy
@ -44,6 +50,8 @@ build:
- mix compile --force - mix compile --force
spec-build: spec-build:
extends:
- .using-ci-base
stage: test stage: test
only: only:
changes: changes:
@ -57,6 +65,8 @@ spec-build:
- mix pleroma.openapi_spec spec.json - mix pleroma.openapi_spec spec.json
benchmark: benchmark:
extends:
- .using-ci-base
stage: benchmark stage: benchmark
when: manual when: manual
variables: variables:
@ -71,6 +81,8 @@ benchmark:
- mix pleroma.load_testing - mix pleroma.load_testing
unit-testing: unit-testing:
extends:
- .using-ci-base
stage: test stage: test
only: only:
changes: *build_changes_policy changes: *build_changes_policy
@ -94,6 +106,8 @@ unit-testing:
path: coverage.xml path: coverage.xml
unit-testing-erratic: unit-testing-erratic:
extends:
- .using-ci-base
stage: test stage: test
retry: 2 retry: 2
allow_failure: true allow_failure: true
@ -129,6 +143,8 @@ unit-testing-erratic:
# - mix test --trace --only federated # - mix test --trace --only federated
unit-testing-rum: unit-testing-rum:
extends:
- .using-ci-base
stage: test stage: test
only: only:
changes: *build_changes_policy changes: *build_changes_policy
@ -162,6 +178,8 @@ lint:
- mix format --check-formatted - mix format --check-formatted
analysis: analysis:
extends:
- .using-ci-base
stage: test stage: test
only: only:
changes: *build_changes_policy changes: *build_changes_policy

View File

@ -14,6 +14,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
### Removed ### Removed
## 2.5.3
### Security
- Emoji pack loader sanitizes pack names
- Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories
## 2.5.2 ## 2.5.2
### Security ### Security

View File

@ -0,0 +1 @@
Emoji pack loader sanitizes pack names

View File

@ -0,0 +1 @@
- Reduced permissions of config files and directories, distros requiring greater permissions like group-read need to pre-create the directories

View File

@ -266,12 +266,20 @@ defmodule Mix.Tasks.Pleroma.Instance do
config_dir = Path.dirname(config_path) config_dir = Path.dirname(config_path)
psql_dir = Path.dirname(psql_path) psql_dir = Path.dirname(psql_path)
# Note: Distros requiring group read (0o750) on those directories should
# pre-create the directories.
[config_dir, psql_dir, static_dir, uploads_dir] [config_dir, psql_dir, static_dir, uploads_dir]
|> Enum.reject(&File.exists?/1) |> Enum.reject(&File.exists?/1)
|> Enum.map(&File.mkdir_p!/1) |> Enum.each(fn dir ->
File.mkdir_p!(dir)
File.chmod!(dir, 0o700)
end)
shell_info("Writing config to #{config_path}.") shell_info("Writing config to #{config_path}.")
# Sadly no fchmod(2) equivalent in Elixir…
File.touch!(config_path)
File.chmod!(config_path, 0o640)
File.write(config_path, result_config) File.write(config_path, result_config)
shell_info("Writing the postgres script to #{psql_path}.") shell_info("Writing the postgres script to #{psql_path}.")
File.write(psql_path, result_psql) File.write(psql_path, result_psql)
@ -290,8 +298,7 @@ defmodule Mix.Tasks.Pleroma.Instance do
else else
shell_error( shell_error(
"The task would have overwritten the following files:\n" <> "The task would have overwritten the following files:\n" <>
(Enum.map(will_overwrite, &"- #{&1}\n") |> Enum.join("")) <> Enum.map_join(will_overwrite, &"- #{&1}\n") <> "Rerun with `--force` to overwrite them."
"Rerun with `--force` to overwrite them."
) )
end end
end end

View File

@ -20,6 +20,20 @@ defmodule Pleroma.Config.ReleaseRuntimeProvider do
with_runtime_config = with_runtime_config =
if File.exists?(config_path) do if File.exists?(config_path) do
# <https://git.pleroma.social/pleroma/pleroma/-/issues/3135>
%File.Stat{mode: mode} = File.lstat!(config_path)
if Bitwise.band(mode, 0o007) > 0 do
raise "Configuration at #{config_path} has world-permissions, execute the following: chmod o= #{config_path}"
end
if Bitwise.band(mode, 0o020) > 0 do
raise "Configuration at #{config_path} has group-wise write permissions, execute the following: chmod g-w #{config_path}"
end
# Note: Elixir doesn't provides a getuid(2)
# so cannot forbid group-read only when config is owned by us
runtime_config = Config.Reader.read!(config_path) runtime_config = Config.Reader.read!(config_path)
with_defaults with_defaults

View File

@ -285,6 +285,7 @@ defmodule Pleroma.Emoji.Pack do
@spec load_pack(String.t()) :: {:ok, t()} | {:error, :file.posix()} @spec load_pack(String.t()) :: {:ok, t()} | {:error, :file.posix()}
def load_pack(name) do def load_pack(name) do
name = Path.basename(name)
pack_file = Path.join([emoji_path(), name, "pack.json"]) pack_file = Path.join([emoji_path(), name, "pack.json"])
with {:ok, _} <- File.stat(pack_file), with {:ok, _} <- File.stat(pack_file),

View File

@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do
def project do def project do
[ [
app: :pleroma, app: :pleroma,
version: version("2.5.2"), version: version("2.5.3"),
elixir: "~> 1.11", elixir: "~> 1.11",
elixirc_paths: elixirc_paths(Mix.env()), elixirc_paths: elixirc_paths(Mix.env()),
compilers: [:phoenix, :gettext] ++ Mix.compilers(), compilers: [:phoenix, :gettext] ++ Mix.compilers(),

View File

@ -17,6 +17,8 @@ defmodule Pleroma.Config.ReleaseRuntimeProviderTest do
end end
test "merged runtime config" do test "merged runtime config" do
assert :ok == File.chmod!("test/fixtures/config/temp.secret.exs", 0o640)
merged = merged =
ReleaseRuntimeProvider.load([], config_path: "test/fixtures/config/temp.secret.exs") ReleaseRuntimeProvider.load([], config_path: "test/fixtures/config/temp.secret.exs")
@ -25,6 +27,8 @@ defmodule Pleroma.Config.ReleaseRuntimeProviderTest do
end end
test "merged exported config" do test "merged exported config" do
assert :ok == File.chmod!("test/fixtures/config/temp.exported_from_db.secret.exs", 0o640)
ExUnit.CaptureIO.capture_io(fn -> ExUnit.CaptureIO.capture_io(fn ->
merged = merged =
ReleaseRuntimeProvider.load([], ReleaseRuntimeProvider.load([],
@ -37,6 +41,9 @@ defmodule Pleroma.Config.ReleaseRuntimeProviderTest do
end end
test "runtime config is merged with exported config" do test "runtime config is merged with exported config" do
assert :ok == File.chmod!("test/fixtures/config/temp.secret.exs", 0o640)
assert :ok == File.chmod!("test/fixtures/config/temp.exported_from_db.secret.exs", 0o640)
merged = merged =
ReleaseRuntimeProvider.load([], ReleaseRuntimeProvider.load([],
config_path: "test/fixtures/config/temp.secret.exs", config_path: "test/fixtures/config/temp.secret.exs",

View File

@ -90,4 +90,8 @@ defmodule Pleroma.Emoji.PackTest do
assert updated_pack.files_count == 1 assert updated_pack.files_count == 1
end end
test "load_pack/1 ignores path traversal in a forged pack name", %{pack: pack} do
assert {:ok, ^pack} = Pack.load_pack("../../../../../dump_pack")
end
end end

View File

@ -65,7 +65,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier.EmojiReactHandlingTest do
object = Object.get_by_ap_id(data["object"]) object = Object.get_by_ap_id(data["object"])
assert object.data["reaction_count"] == 1 assert object.data["reaction_count"] == 1
assert match?([[emoji, _]], object.data["reactions"]) assert match?([[^emoji, _]], object.data["reactions"])
end end
test "it reject invalid emoji reactions" do test "it reject invalid emoji reactions" do

View File

@ -375,7 +375,7 @@ defmodule Pleroma.Web.MastodonAPI.UpdateCredentialsTest do
"pleroma_background_image" => new_background_oversized "pleroma_background_image" => new_background_oversized
}) })
assert user_response = json_response_and_validate_schema(res, 413) assert _user_response = json_response_and_validate_schema(res, 413)
assert user.background == %{} assert user.background == %{}
clear_config([:instance, :upload_limit], upload_limit) clear_config([:instance, :upload_limit], upload_limit)