6 Commits

Author	SHA1	Message	Date
Stanko K.R.	0672673916	Disallow SSRF via IPv6 addresses mapped to IPv4 addresses	2025-12-03 08:08:34 +01:00
Jeremy Daer	5667262d1c	Security: disallow blind SSRF to link-local IPs via URL unfurling	2025-12-02 21:33:44 -08:00
Stanko K.R.	4d04f9beee	Use urlsafe base64 decode	2025-12-02 11:34:12 +01:00
Stanko K.R.	bebe518c74	Parse Rails 7 GIDs	2025-12-02 11:06:23 +01:00
Stanko Krtalić	eecdb29332	Upgrade to Rails 8 and Ruby 3.4.5 (#1) ... * Bump Ruby to 3.4.5 * Update dependencies * Adjust for Rails 8 and Ruby 3.5 API changes * Mark params strings as mutable in prepapration for frozen strings in Ruby 3.5 * Update test for HTML5 sanitizer With Rails 7.1 the HTML5 sanitizer became the default, this breakts this test because the old sanitizer used to delete unpermitted nodes, while the new one returns their content The final string is safe, but different then it used to be in Rails 7.0 * Remove direct Turbo tesh helpers require & parallelize tests * Fix Zeitwerk issues with rails extensions * Update Resque setup for Redis 5+ * Remove unused views * Remove GID v1 handler	2025-09-02 17:02:41 +02:00
Kevin McConnell	df76a227dc	Hello world ... First open source release of Campfire 🎉	2025-08-21 09:31:59 +01:00