Skip to content

RailsPress 1.4.4

Latest
Latest

Choose a tag to compare

View all tags
@aviflombaum aviflombaum released this 18 Aug 21:59
v1.4.4
3c91306
This commit was signed with the committer’s verified signature.
aviflombaum Avi Flombaum
SSH Key Fingerprint: DPOeii6VJiO0O4yiFEhsJraTM7sJhvlp6PEBm+qYbMs
Verified
Learn about vigilant mode.

Added

  • SSRF-safe remote images: Added ssrf_filter as an engine dependency for remote post header-image imports.

Security

  • Import upload containment: Store admin uploads under server-generated names and canonicalize cleanup targets before removing files.
  • ZIP image containment: Reject absolute, traversal, and symlinked image references that resolve outside the extraction directory.
  • Remote image destination validation: Reject loopback, private, link-local, reserved, and other unsafe IPv4 and IPv6 destinations. Remote image redirects are rejected.
  • Dependency maintenance: Updated the development lockfile to patched rails-html-sanitizer 1.7.1 and json 2.21.2 releases.

Upgrade notes

  • Run bundle update railspress-engine.
  • Remote post images must resolve directly to a public HTTP or HTTPS destination. Redirecting image URLs are no longer accepted.
  • No migrations, initializer changes, or host application code changes are required.
Assets 2
Loading