diff --git a/Changelog.md b/Changelog.md index bb6c65421..57e971bd7 100644 --- a/Changelog.md +++ b/Changelog.md @@ -1,3 +1,9 @@ +# 0.5.7.1 + +This security release disables post fetching for relayables. Due to an insecure implementation, fetching of root posts for relayables could allow an attacker to distribute malicious/spoofed/modified posts for any person. + +Disabling the fetching will make the current federation a bit less reliable, but for a hotfix, this is the best solution. We will re-enable the fetching in 0.6.0.0 when we moved out the federation into its own library and are able to implement further validation during fetches. + # 0.5.7.0 ## Refactor diff --git a/config/defaults.yml b/config/defaults.yml index f49b6eb07..899646884 100644 --- a/config/defaults.yml +++ b/config/defaults.yml @@ -4,7 +4,7 @@ defaults: version: - number: "0.5.7.0" # Do not touch unless doing a release, do not backport the version number that's in master + number: "0.5.7.1" # Do not touch unless doing a release, do not backport the version number that's in master heroku: false environment: url: "http://localhost:3000/" diff --git a/lib/federated/relayable.rb b/lib/federated/relayable.rb index 7a1b13d6c..cd5ec3b74 100644 --- a/lib/federated/relayable.rb +++ b/lib/federated/relayable.rb @@ -40,7 +40,7 @@ module Federated end def fetch_parent guid - Diaspora::Fetcher::Single.find_or_fetch_from_remote guid, diaspora_handle + raise Diaspora::PostNotFetchable end end end