mastodon

i18n/crowdin/translations

renovate/eslint-(non-major)

renovate/sanitize-7.x

renovate/yarn-monorepo

renovate/postcss-preset-env-10.x-lockfile

renovate/bufferutil-4.x-lockfile

renovate/docker.io-ruby-3.x

renovate/ox-2.x-lockfile

renovate/rubocop-(non-major)

renovate/nokogiri-1.x-lockfile

renovate/rack-test-2.x-lockfile

renovate/pino-9.x-lockfile

renovate/csv-3.x-lockfile

main

feat/fasp

renovate/definitelytyped-types-(non-major)

features/numeric-identifiers

renovate/omniauth-packages

renovate/major-react-monorepo

fixes/notification-trailing-groups

renovate/reduxjs-toolkit-2.x-lockfile

renovate/webpush-digest

feature-streaming-profile

renovate/formatjs-monorepo

feature-starter-packs

refactor-status-content-typescript

renovate/glob-11.x

renovate/react-test-renderer-19.x

fixes/embed-requestAnimationFrame

renovate/immutable-5.x

stable-4.3

stable-4.1

stable-4.2

renovate/net-http-0.x

renovate/major-formatjs-monorepo

features/lock-icon-on-hover-card

renovate/typescript-5.x-lockfile

feature-language-dropdown-warning

feature-admin-report-forward

feature-reports-batch-actions

fix-admin-dashboard-slow

fix-future-date-trend

redesign/content-warning-filters-4.3

fixes/filtered-follows

remove/trendable-provider-attribution

activitypub/summary-over-name

build-stable-nightly

fixes/notification-excerpt-paragraph

fixes/mastodon-setup-task-redis

fixes/out-of-order-private-posts

fixes/regexp-timeout-optional

fixes/small-otp-secret-length-4.1

fixes/small-otp-secret-length-4.2

fixes/dashboard-quick-access-overflow

fixes/middle-column-size

fix-context-socialweb-miscellany

cleanup/remove-old-notifications

fixes/detect-missing-indexes2

cleanup/simplify-css

feature-post-layout

features/media-description-in-embedded-status

design/notifications-grid

fix-lookup-domain

flaky-conversations-test

fixes/crash-orphaned-notification

fixes/report-links

features/filtered-dismiss-accept-all

feat/clean-up-notifications

fixes/everyone-role-n+1

redesign/notification-request

experimental/notification-groups-api-shape

fixes/thread-resolve-worker-skip_fetching

spike/resolve-urls-on-click

cleanup/drop-atomuri

fixes/dismissing-notification-requests-dismisses-too-much

revert-system-check

feature-redirect

fix-unusable-hashtag

tests/flaky-tests-performance-logs

feature-grouped-notifications-ui

drop-redis-below-6.2

fix-mute-buttons

features/local-preview-cards-2nd-take

fix-conversations-background

revert-severed-relationships-feature

features/local-preview-cards

stable-3.5

stable-4.0

stable-3.4

releases/v3.5.17

releases/v4.1.13

releases/v4.2.5

version/v4.3.0-alpha.1

fix/build-env

feature-color-scheme

revert/follow-back-mutual

gh-readonly-queue/main/pr-28626-1ad908e0c08c236389967d86b4f238f428de9fef

fixes/per-user-authorized-fetch

fixes/import-many-follows-overlap

fix-web-thread-sort

test-new-container-build

fixes/24px-icons

features/registration-invite-api

fixes/service-worker-caching

fixes/account-refresh-link-verification

feature-like

tests/introduce-error

fixes/lint-fix

fixes/object-has-own-polyfill

fixes/audio-passthrough

fixes/audit-log-external-confirmation

features/banners

refactor/search-query-parser

remove-profile-directory

redesign/notification-settings

feature-separate-hashtags

fixes/self-destruct-throttle

fixes/subdomain-block-4.1.6

redesign/hashtag-column-follow-button

feature-trend-highlights

revert-23460-fixes/activitypub-hashtag

pg15

prevent-unauthenticated-access-tag-timeline

support-rich-oembed

fix-caniuselite-lockfile

track_unsalvageable_errors

add-publish-button-text-site-setting

nolan/button-a11y

i18n/manage-translations

deps/shakapacker

rubocop-fixes

react18

stable-3.3

stable-3.2

stable-3.1

stable-3.0

stable-2.9

stable-2.8

stable-2.7

stable-2.5

stable-2.6

stable-2.4

v0.1.2

v0.1.1

v0.1.0

v0.6

v0.7

v0.8

v0.9

v0.9.9

v1.0

v1.1

v1.1.1

v1.1.2

v1.2

v1.2.1

v1.2.2

v1.3

v1.3.1

v1.3.2

v1.3.3

v1.4.1

v1.4.2

v1.4.3

v1.4.4

v1.4.5

v1.4.6

v1.4.7

v1.4rc1

v1.4rc2

v1.4rc3

v1.4rc4

v1.4rc5

v1.4rc6

v1.5.0

v1.5.0rc1

v1.5.0rc2

v1.5.0rc3

v1.5.1

v1.6.0

v1.6.0rc1

v1.6.0rc2

v1.6.0rc3

v1.6.0rc4

v1.6.0rc5

v1.6.1

v2.0.0

v2.0.0rc1

v2.0.0rc2

v2.0.0rc3

v2.0.0rc4

v2.1.0

v2.1.0rc1

v2.1.0rc2

v2.1.0rc3

v2.1.0rc4

v2.1.0rc5

v2.1.0rc6

v2.1.1

v2.1.2

v2.1.3

v2.2.0

v2.2.0rc1

v2.2.0rc2

v2.3.0

v2.3.0rc1

v2.3.0rc2

v2.3.0rc3

v2.3.1

v2.3.1rc1

v2.3.1rc2

v2.3.1rc3

v2.3.2

v2.3.2rc1

v2.3.2rc2

v2.3.2rc3

v2.3.2rc4

v2.3.2rc5

v2.3.3

v2.4.0

v2.4.0rc1

v2.4.0rc2

v2.4.0rc3

v2.4.0rc4

v2.4.0rc5

v2.4.1

v2.4.1rc1

v2.4.1rc2

v2.4.1rc3

v2.4.1rc4

v2.4.2

v2.4.2rc1

v2.4.2rc2

v2.4.2rc3

v2.4.3

v2.4.3rc1

v2.4.3rc2

v2.4.3rc3

v2.4.4

v2.4.5

v2.5.0

v2.5.0rc1

v2.5.0rc2

v2.5.1

v2.5.2

v2.6.0

v2.6.0rc1

v2.6.0rc2

v2.6.0rc3

v2.6.0rc4

v2.6.1

v2.6.2

v2.6.3

v2.6.4

v2.6.5

v2.7.0

v2.7.0rc1

v2.7.0rc2

v2.7.0rc3

v2.7.1

v2.7.2

v2.7.3

v2.7.4

v2.8.0

v2.8.0rc1

v2.8.0rc2

v2.8.0rc3

v2.8.1

v2.8.2

v2.8.3

v2.8.4

v2.9.0

v2.9.0rc1

v2.9.0rc2

v2.9.1

v2.9.2

v2.9.3

v2.9.4

v3.0.0

v3.0.0rc1

v3.0.0rc2

v3.0.0rc3

v3.0.1

v3.0.2

v3.1.0

v3.1.0rc1

v3.1.0rc2

v3.1.1

v3.1.2

v3.1.3

v3.1.4

v3.1.5

v3.2.0

v3.2.0rc1

v3.2.0rc2

v3.2.1

v3.2.2

v3.3.0

v3.3.0rc1

v3.3.0rc2

v3.3.0rc3

v3.3.1

v3.3.2

v3.3.3

v3.4.0

v3.4.0rc1

v3.4.0rc2

v3.4.1

v3.4.10

v3.4.2

v3.4.3

v3.4.4

v3.4.5

v3.4.6

v3.4.7

v3.4.8

v3.4.9

v3.5.0

v3.5.0rc1

v3.5.0rc2

v3.5.0rc3

v3.5.1

v3.5.10

v3.5.11

v3.5.12

v3.5.13

v3.5.14

v3.5.15

v3.5.16

v3.5.17

v3.5.18

v3.5.19

v3.5.2

v3.5.3

v3.5.4

v3.5.5

v3.5.6

v3.5.7

v3.5.8

v3.5.9

v4.0.0

v4.0.0rc1

v4.0.0rc2

v4.0.0rc3

v4.0.0rc4

v4.0.1

v4.0.10

v4.0.11

v4.0.12

v4.0.13

v4.0.14

v4.0.15

v4.0.2

v4.0.3

v4.0.4

v4.0.5

v4.0.6

v4.0.7

v4.0.8

v4.0.9

v4.1.0

v4.1.0rc1

v4.1.0rc2

v4.1.0rc3

v4.1.1

v4.1.10

v4.1.11

v4.1.12

v4.1.13

v4.1.14

v4.1.15

v4.1.16

v4.1.17

v4.1.18

v4.1.19

v4.1.2

v4.1.20

v4.1.21

v4.1.3

v4.1.4

v4.1.5

v4.1.6

v4.1.7

v4.1.8

v4.1.9

v4.2.0

v4.2.0-beta1

v4.2.0-beta2

v4.2.0-beta3

v4.2.0-rc1

v4.2.0-rc2

v4.2.1

v4.2.10

v4.2.11

v4.2.12

v4.2.13

v4.2.14

v4.2.2

v4.2.3

v4.2.4

v4.2.5

v4.2.6

v4.2.7

v4.2.8

v4.2.9

v4.3.0

v4.3.0-beta.1

v4.3.0-beta.2

v4.3.0-rc.1

v4.3.1

v4.3.2

Commit Graph

Author	SHA1	Message	Date
rinsuki	6e736f2452	fix: embed.js doesn't expands iframes height (#18301 ) also including some refactoring: - add `// @ts-check` - use Map to completely avoid prototype pollution - assign random id to each iframe for reduce chance to brute-force attack, and leak of iframe counts - check iframe.contentWindow and MessageEvent.source to validate message is coming from correct iframe (it works on latest Chrome/Firefox/Safari but I'm not sure this is allowed by spec) follow-up of #17420 fix #18299	3 years ago
Rohan Sharma	4d6d4b43c6	Fixed prototype pollution bug and only allow trusted origin (#17420 )	3 years ago
Eugen Rochko	6867681c7c	Add script to make embedded iframes autosize (#4853 )	7 years ago

Author

SHA1

Message

Date

rinsuki

6e736f2452

fix: embed.js doesn't expands iframes height (#18301 )

also including some refactoring:
- add `// @ts-check`
- use Map to completely avoid prototype pollution
- assign random id to each iframe for reduce chance to brute-force attack, and leak of iframe counts
- check iframe.contentWindow and MessageEvent.source to validate message is coming from correct iframe (it works on latest Chrome/Firefox/Safari but I'm not sure this is allowed by spec)

follow-up of #17420
fix #18299

Rohan Sharma

4d6d4b43c6

Fixed prototype pollution bug and only allow trusted origin (#17420 )

Eugen Rochko

6867681c7c

Add script to make embedded iframes autosize (#4853 )

3 Commits (8f073818568b78b4adb858feb928b0da237d066a)