23 Commits (eaadf425f2505eaae630cae65dbbbc09f4eab06a)

Author	SHA1	Message	Date
Your Name	87ed60d675	Accept compacted Note attachments (#6588) ... Normalize JSON-LD compacted single attachments (a bare object instead of a one-item array) in getAttachments(), and route verifyAttachments() through it so validation and import share one normalization path. Includes PR #6589's tests plus additional edge-case coverage: list-form preservation, bare-input normalization, and guards for missing/empty/scalar attachments.	4 weeks ago
Your Name	3d82a8e8b2	Fix unauthenticated SSRF in remote media/avatar fetch (variant of CVE-2026-71246) ... The remote media path validated URLs only as strings (Helpers::validateUrl normalizes the host + checks a ban list) and then downloaded them with Http::head + file_get_contents($url), which resolve DNS themselves and follow redirects with no private-IP checks and no address pinning. A remote actor whose icon.url redirected to an internal address (e.g. 172.18.0.1 or 169.254.169.254) made the queue worker fetch internal content and, for image responses, republish it at a public avatar URL. No account required. Fixes: - Add SecureMediaFetchService: validates URL, resolves + rejects non-global IPs (fail-closed), pins the connection to the validated IP via CURLOPT_RESOLVE, disables auto-redirects with per-hop re-validation, and enforces https-only + a byte cap. Mirrors the ActivityPubFetchService hardening from CVE-2026-71246. - Route MediaStorageService head()/fetchAvatar()/remoteToCloud() through it, removing the bare Http::head and file_get_contents($url) sinks. - validateUrl(): when DNS verification is enabled, reject hosts that resolve into reserved ranges, closing the metadata.google.internal bypass. - Harden adjacent same-class sinks: CustomEmojiService (emoji doc + image + head), FetchCacheService/webfinger, and DiscoverActor. - Add regression tests (tests/Unit/ActivityPub/SsrfUrlValidationTest.php).	4 weeks ago
Your Name	43040a2275	fix: add missing property declarations (phpstan property.notFound) ... - Add $fractal property and initialization to NewPublicPost event - Add $mastodon and $pleroma property declarations to AudienceScopeTest	4 weeks ago
Your Name	de3375a9f9	Apply Pint formatting to tests/	1 month ago
daniel	0158941fb6	API improvements + test fixes (#5925) ... * migrate PHPUnit configuration * replace @test annotations with #[Test] attributes, and add it where it was missing * remove test prefix from test method names * add PHPUnit cache to .gitignore * Update ApiV1Controller, fix notifications favourited/reblogged/bookmarked state. Fixes #5901 * Update ApiV1Controller, fix relationship fields. Fixes #5900 * Update instance config, return proper matrix limits. Fixes #4780 * Update SearchApiV2Service, fix offset bug. Fixes #5875 * Update ApiV1Controller, add better direct error message. Fixes #4789 * Update changelog --------- Co-authored-by: Daniel Simon <daniel.simon.dev@proton.me>	1 year ago
Daniel Supernault	0f72b33c0e	Add tests	3 years ago
Daniel Supernault	222dc3a192	Update test	4 years ago
Daniel Supernault	fb584c02a6	Update NoteAttachmentTest	4 years ago
Sven Luijten	13d359a3c5	Clean up styling in the tests	4 years ago
Daniel Supernault	e95b702e23	Add activitypub story validator	5 years ago
Daniel Supernault	044ad6450f	Update tests, fix namespace	6 years ago
Daniel Supernault	5c5931200b	Add AP LikeTest	6 years ago
Daniel Supernault	802dd326ce	Update AP tests	6 years ago
Daniel Supernault	84fba79f0e	Add new tests	7 years ago
Daniel Supernault	59340dee69	Add FollowTest	7 years ago
Daniel Supernault	43073bd226	Add AcceptVerbTest	7 years ago
Daniel Supernault	4227af1288	Add UndoFollowTest	7 years ago
Daniel Supernault	79da0692b4	Update Test	8 years ago
Daniel Supernault	0c654f5e43	Update tests	8 years ago
Daniel Supernault	c78686e355	Add Announce validator and test	8 years ago
Daniel Supernault	714e47f387	Add Accept validator/test	8 years ago
Daniel Supernault	5b4d76a32e	Add AudienceScope test	8 years ago
Daniel Supernault	e0a5eadaeb	Add AP Note test	8 years ago