Skip to content

Lamb 0.12.0

Latest
Latest

Choose a tag to compare

View all tags
@svandragt svandragt released this 25 Jul 11:34
0.12.0
618488a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Lamb 0.12.0 is a big one: a full security review closing eleven vulnerabilities (some remotely triggerable, no credentials needed), plus WordPress import, JSON Feed subscribing, sitemap/robots.txt generation, and a handful of writing and admin improvements.

Added

  • WordPress import. Bring an existing WordPress export (WXR file) in as posts, downloading its images and converting HTML to Markdown along the way. See Importing.
  • JSON Feed support. Cross-posting from feeds now understands JSON Feed sources, not just RSS/Atom. See Cross-posting from feeds.
  • Sitemap and robots.txt. /sitemap.xml and /robots.txt are generated automatically, with private routes excluded from crawling.
  • microformats2 markup. Themes now emit h-entry/h-card markup, so posts are readable by IndieWeb readers and tools.
  • POSSE syndication tracking. Configure syndication targets and Lamb records what a post syndicated to, showing the links on the post. See Syndication.
  • Redirections tab. Settings now lists the automatic redirects Lamb has created when slugs changed.
  • Drag-and-drop video uploads in the post editor, alongside images.
  • Meta description on pages, for link previews and search results.

Changed

  • Micropub now requires a canonical site URL to be configured (see Upgrade notes — this is the one to read).
  • Deleted/trashed posts with a missing deletion timestamp are now correctly excluded from the trash purge.
  • Root-relative image URLs are absolutised in feeds and OpenGraph tags, so images show up correctly for readers off-site.
  • Configuration values and front-matter fields written in the wrong shape (e.g. a list where text is expected) are now coerced or dropped with a warning at save time, instead of crashing the page.

Fixed

Eleven security fixes, the two most serious remotely triggerable without any credentials:

  • Micropub authentication bypass via a spoofed Host header (critical). A token issued for an attacker's own domain could be replayed against your site by sending a matching Host header, granting unauthenticated create/update/delete on posts. Fixed by comparing tokens against an explicitly configured site URL rather than the request's Host header.
  • Front matter could overwrite or delete arbitrary posts (high). A Micropub client with only create scope could smuggle an id: or deleted: front-matter key to overwrite or trash any post, bypassing scope checks.
  • Stored XSS via hashtag linkification (high). A hashtag inside an image alt or link title (including from an ingested feed) could break out of the attribute and inject a working event handler.
  • Unbounded outbound HTTP requests. Webmention and feed-crawl fetches lacked response-size caps, and Micropub token verification followed redirects — a malicious redirect could leak the bearer token to another host.
  • WebSub hub pings had no URL guard, allowing a hub value to reach an internal address (SSRF).
  • Upload content wasn't checked against its extension, so non-image bytes (e.g. HTML/SVG) could be stored and served from your own domain under an image filename; uploads are now sniffed by content, not just name.
  • PHP execution under /assets is now blocked at the web server level.
  • Several SSRF fixes in feed ingestion, webmention fetching, and the WordPress image importer (redirects and hostnames weren't fully guarded).
  • Open redirect via slug-based auto-redirect; existence oracle for draft/trashed/scheduled posts via webmention target; missing scope checks on Micropub delete/undelete and the media endpoint; source-query disclosure of unpublished content.
  • Decompression-bomb DoS in image upload, and predictable upload filenames that could silently overwrite another file.
  • A /_cron race (TOCTOU) that allowed concurrent runs under load.
  • Security response headers (X-Content-Type-Options, Referrer-Policy, X-Frame-Options) are now set; expose_php is off in the release image.

Upgrade notes

  • Set a canonical site URL before upgrading, or Micropub will stop working. Add site_url = https://your-site.example in Settings, or set the LAMB_SITE_URL environment variable. Token verification now fails closed without it — this is what closes the Micropub auth bypass described above. See Site configuration and Micropub.
  • No new PHP extensions are required for WordPress import (uses the existing simplexml/DOM support).
Assets 3
Loading