Comment on Probably want to stop using Booklore...
PoliteDudeInTheMood@lemmy.ca 3 days ago- Fixed credential-exfiltration risk in /api/proxy/image: Previously the endpoint could:
- accept arbitrary auth_id
- load stored API keys
- forward them to attacker-controlled URLs
- Enforced outbound host allowlist globally Previously:
- allowlist existed
- but outgoingFetch() didn’t enforce it
- plugins/engines could bypass it
- Fixed extension store path traversal Previously a malicious store manifest could:
- inject … paths
- escape install directories
- reference arbitrary files
- Hardened proxy IP trust Previously:
- rate limiting trusted any X-Forwarded-For header
- clients could spoof their IP
- Fixed inconsistent settings authentication Previously:
- settings UI stored an auth token
- but the settings modal didn’t send it when saving
- Implemented Improved proxy deployment support
- Added proxy-aware behavior:
- DEGOOG_PUBLIC_BASE_URL for canonical URLs
- secure cookie handling when X-Forwarded-Proto=https
Additional Improvements:
- suggestion fetching hardened
- DuckDuckGo suggestion parsing fixed
- unified outbound request handling
- install state guard properly cleaned up
fccview@lemmy.world 3 days ago
Thanks, I’ll individually look into all of these ♥️ I’ll say some of them are more conscious compromises for the sake of an open scalable system where third party extensions can truly edit anything (intentionally) and everything around Auth/secure cookie is also fairly lax due to the fact the Auth is just a protection for the settings (which literally stop the settings from being served by the client), in the moment I decide to add some more structured Auth system/maybe users I’ll look into proper secure cookie handling.
This is an awesome report, thank you so much for sharing it!!!