6 Commits (dev)

Author	SHA1	Message	Date
Your Name	3d82a8e8b2	Fix unauthenticated SSRF in remote media/avatar fetch (variant of CVE-2026-71246) ... The remote media path validated URLs only as strings (Helpers::validateUrl normalizes the host + checks a ban list) and then downloaded them with Http::head + file_get_contents($url), which resolve DNS themselves and follow redirects with no private-IP checks and no address pinning. A remote actor whose icon.url redirected to an internal address (e.g. 172.18.0.1 or 169.254.169.254) made the queue worker fetch internal content and, for image responses, republish it at a public avatar URL. No account required. Fixes: - Add SecureMediaFetchService: validates URL, resolves + rejects non-global IPs (fail-closed), pins the connection to the validated IP via CURLOPT_RESOLVE, disables auto-redirects with per-hop re-validation, and enforces https-only + a byte cap. Mirrors the ActivityPubFetchService hardening from CVE-2026-71246. - Route MediaStorageService head()/fetchAvatar()/remoteToCloud() through it, removing the bare Http::head and file_get_contents($url) sinks. - validateUrl(): when DNS verification is enabled, reject hosts that resolve into reserved ranges, closing the metadata.google.internal bypass. - Harden adjacent same-class sinks: CustomEmojiService (emoji doc + image + head), FetchCacheService/webfinger, and DiscoverActor. - Add regression tests (tests/Unit/ActivityPub/SsrfUrlValidationTest.php).	4 weeks ago
Your Name	15cc07e602	Fix all class.notFound PHPStan issues - 31 fixes	11 months ago
Daniel Supernault	312386bf98	Update DiscoverActor, fix formatting	2 years ago
Kirk Strauser	5d263d1c2e	PixelFed -> Pixelfed ... There was a remaining mix of capital-F "PixelFed" occurrences. This changes everything to the same capitalization, "Pixelfed", for consistency.	7 years ago
daniel	b8abbdd90f	Apply fixes from StyleCI	8 years ago
Daniel Supernault	6f8122bed6	Add ActivityPub DiscoverActor util	8 years ago