v1.24.0
Important security release
PlaywrightCapture did not sufficiently restrict navigation and resource requests initiated by rendered pages. Find more details in the advisory: GHSA-687h-xw6f-q2qw
Please update any Lacus instance used to render untrusted pages (that's all of them 🙃).
POC
The call below was rendering /etc/passwd from the machine Lacus is running on. That applies to any file the user running lacus can read.
curl -s -X POST "http://<domain>/enqueue" -H "Content-Type: application/json" -d '{
"document": "'$(echo '<html><body><script>window.location.href="file:///etc/passwd";</script></body></html>' | base64 -w0)'",
"document_name": "test.html"
}'The fix also blocks calls to non-global IPs that could be triggered by the rendered page.
Thank you very much to @jeroengui for the report and PoC.
New features
- Add support for remote interactive headfull captures using xpra-html5. To use it, you need to install xpra (see readme).
This feature should be considered beta at this stage and the API is subject to changes.
Screencast_20260430_163512.webm
- Expose instance settings so a user knows what can be captured (tor, i2p) and how (headed, remote headed) and if the trusted timestamps are automatically generated.
Changes
- Many improvement sin the logging system
- Use latest playwright
What's Changed
- feat: interactive capture sessions with Tactus sidecar by @DocArmoryTech in #68
New Contributors
- @DocArmoryTech made their first contribution in #68
Full Changelog: v1.23.0...v1.24.0
Contributors
DocArmoryTech and jeroengui