Comment on Probably want to stop using Booklore...

• PoliteDudeInTheMood@lemmy.ca ⁨3⁩ ⁨days⁩ ago

  1. Fixed credential-exfiltration risk in /api/proxy/image: Previously the endpoint could:

  • accept arbitrary auth_id
  • load stored API keys
  • forward them to attacker-controlled URLs

  2. Enforced outbound host allowlist globally Previously:

  • allowlist existed
  • but outgoingFetch() didn’t enforce it
  • plugins/engines could bypass it

  3. Fixed extension store path traversal Previously a malicious store manifest could:

  • inject … paths
  • escape install directories
  • reference arbitrary files

  4. Hardened proxy IP trust Previously:

  • rate limiting trusted any X-Forwarded-For header
  • clients could spoof their IP

  5. Fixed inconsistent settings authentication Previously:

  • settings UI stored an auth token
  • but the settings modal didn’t send it when saving

  6. Implemented Improved proxy deployment support

  • Added proxy-aware behavior:
  • DEGOOG_PUBLIC_BASE_URL for canonical URLs
  • secure cookie handling when X-Forwarded-Proto=https

  Additional Improvements:

  • suggestion fetching hardened
  • DuckDuckGo suggestion parsing fixed
  • unified outbound request handling
  • install state guard properly cleaned up

  source

  • fccview@lemmy.world ⁨3⁩ ⁨days⁩ ago

    Thanks, I’ll individually look into all of these ♥️ I’ll say some of them are more conscious compromises for the sake of an open scalable system where third party extensions can truly edit anything (intentionally) and everything around Auth/secure cookie is also fairly lax due to the fact the Auth is just a protection for the settings (which literally stop the settings from being served by the client), in the moment I decide to add some more structured Auth system/maybe users I’ll look into proper secure cookie handling.

    This is an awesome report, thank you so much for sharing it!!!

    source