Miniflux 2.0.43
-
Avoid XSS when opening a broken image due to unescaped ServerError in proxy handler (CVE-2023-27592)
Creating an RSS feed item with the inline description containing an<img>tag
with asrcsetattribute pointing to an invalid URL like
http:a<script>alert(1)</script>, we can coerce the proxy handler into an error
condition where the invalid URL is returned unescaped and in full.This results in JavaScript execution on the Miniflux instance as soon as the
user is convinced to open the broken image. -
Use
r.RemoteAddrto check/metricsendpoint network access (CVE-2023-27591)
HTTP headers likeX-Forwarded-FororX-Real-Ipcan be easily spoofed. As
such, it cannot be used to test if the client IP is allowed.The recommendation is to use HTTP Basic authentication to protect the
metrics endpoint, or run Miniflux behind a trusted reverse-proxy. -
Add HTTP Basic authentication for
/metricsendpoint -
Add proxy support for several media types
-
Parse feed categories from RSS, Atom and JSON feeds
-
Ignore empty link when discovering feeds
-
Disable CGO explicitly to make sure the binary is statically linked
-
Add CSS classes to differentiate between category/feed/entry view and icons
-
Add rewrite and scraper rules for
blog.cloudflare.com -
Add
color-schemeto themes -
Add new keyboard shortcut to toggle open/close entry attachments section
-
Sanitizer: allow
idattribute in<sup>element -
Add Indonesian Language
-
Update translations
-
Update Docker Compose examples:
- Run the application in one command
- Bring back the health check condition to
depends_on - Remove deprecated
versionelement
-
Update scraping rules for
ilpost.it -
Bump
github.com/PuerkitoBio/goqueryfrom1.8.0to1.8.1 -
Bump
github.com/tdewolff/minify/v2from2.12.4to2.12.5 -
Bump
github.com/yuin/goldmarkfrom1.5.3to1.5.4 -
Bump
golang.org/x/*dependencies