Headline
CVE-2023-42451: Merge pull request from GHSA-v3xf-c9qf-j667 · mastodon/mastodon@eeab356
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.
Expand Up
@@ -7,18 +7,18 @@ class TagManager
include RoutingHelper
def web_domain?(domain)
domain.nil? || domain.delete(‘/’).casecmp(Rails.configuration.x.web_domain).zero?
domain.nil? || domain.delete_suffix(‘/’).casecmp(Rails.configuration.x.web_domain).zero?
end
def local_domain?(domain)
domain.nil? || domain.delete(‘/’).casecmp(Rails.configuration.x.local_domain).zero?
domain.nil? || domain.delete_suffix(‘/’).casecmp(Rails.configuration.x.local_domain).zero?
end
def normalize_domain(domain)
return if domain.nil?
uri = Addressable::URI.new
uri.host = domain.delete(‘/’)
uri.host = domain.delete_suffix(‘/’)
uri.normalized_host
end
Expand Down