Magpie 0.1.3

Magpie 0.1.3: security fixes

This release fixes several security issues found in an audit. Everyone on 0.1.2 or earlier should update.

Security

• Importing a crafted backup could make a later download write files outside your library, and send your GitHub token to another site. Fixed.
• A crafted backup could make Magpie serve or delete files in its data folder, including the database with your API keys. Fixed.
• iPhone: opening a magpie://pair link now asks before switching to another Mac, and names that Mac.
• The browser extension, Mac app and Windows launcher now check that the local server really is your Magpie before sending your sign-in token.
• Only web (http/https) links can be saved or opened.
• Magpie no longer fetches pages from private or local network addresses. Set ALLOW_PRIVATE_URLS=true if you save pages from your own network.
• Backup imports are limited in size, in number of files and in how far they can unpack (zip bomb protection).

Other

• Releases are now built and published automatically.

Verify downloads against SHA256SUMS.txt. The Mac app is not notarized yet: on first launch, allow it in System Settings → Privacy & Security → Open Anyway.