Skip to content

MediaClean 0.1.6

Latest
Latest

Choose a tag to compare

View all tags
@neurallab-dev neurallab-dev released this 11 Jul 23:31
v0.1.6
511dbf4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MediaClean 0.1.6 security patch.

Fixes:

  • Reject non-loopback Host headers and cross-origin writes on the local server, closing a DNS-rebinding / CSRF path where a visited web page could drive scan / quarantine / purge against your files. _is_loopback_host was previously only checked at bind time, never per request.
  • Plural-agreement fix in the keeper reason ("2 other copy looks like…" → "2 other copies look like…").

Verification:

  • pytest: 19 passed (new end-to-end guard test for rebound reads/writes and cross-origin writes)
  • Developer ID signed, Apple-notarized, stapled, and Gatekeeper accepted

SHA-256: 2bf6af486566eca1365864a4d6b5ea9a3636ef8ca3022088d206009559ad08ab

Assets 3
Loading