The disconnect handler for the realtime connection checks whether the
disconnecting socket was the last user for that note. If that's the
case and the note had unsaved changes, it persists them to the database
which is an async progress. In the callback of this async progress, the
note and all its pending changes (should be empty) are deleted.
However, when the user reconnects quickly because of a flaky
connection, it could happen that they create new pending changes before
the database saving finished. As there was no additional "no-users"
check before clearing the note, this could lead to content loss.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The addition of external link warning has changed the behavior of
opening links from opening in a new tab to opening in the same tab.
This restores the old behavior and opens all links in a new tab.
Signed-off-by: Tony Chau <90050474+fo5for@users.noreply.github.com>
The permission checks did not check for unknown permission values
submitted to the server. This allowed bypassing permission checks
under certain circumstances. However, this is not as critical as
it might sound at first, since checks guard that only the owner
can modify note permissions and the owner already has always
full permission to their note.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Since it is heavily requested by users, this adds a new config option
to disable the previously introduced external link warning.
Be aware however, that disabling this config option weakens the
security of your HedgeDoc instance and is therefore only recommended
for closed trustworthy user groups.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This change removes the meta-marked dependency which solely was
used for extracting the frontmatter, which is possible as well
with one function. Furthermore, this introduces constraints to
objects resulting from frontmatter parsing and enforces them in
order to prevent attacks like a yaml bomb (massive alias expansion).
This change should resolve a possible DoS attack.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The state of the OAuth2 response was not verified.
In theory an attacker could use this to extract the contents of a note.
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously, maliciously crafted email addresses
could be used to sneak HTML code into the HedgeDoc
editor, since HedgeDoc uses the local part of the
address as a display name for users.
We're now sanitizing this using DOMPurify.
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Allow the admin to specify the rate-limits for user signup / login
Allow the admin to specify if Cloudflare specific rate-limit functionality should be used or not
Signed-off-by: Philip Molares <philip.molares@udo.edu>
A malicious user could modify a valid looking link (for example of the editor UI)
to point to a malicous site, by using overlays and CSS. Since CSS should stay
enabled, we need to make the user aware of possible risks when leaving the
HedgeDoc instance, in order to protect them from credential-theft.
This commit adds a new interstitial page for external links, that shows the
target URL and asks the user, whether they really want to continue.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
When 5+ users edit concurrently, revision gaps trigger the Stale state
which throws 'Ignored server-side change.' on incoming operations. This
causes document divergence, silent data corruption, and eventually
force-resets that discard local edits.
Changes:
- Stale/StaleWithBuffer.applyServer: buffer incoming operations instead
of throwing, apply them sequentially after missing ops arrive
- Stale.applyClient: carry pendingOps to StaleWithBuffer on transition
- editor-socketio-server: retry-based force-reset (3 failures) instead
of immediate nuclear reset on any OT error
- hex2rgb: defensive null checks for old non-hex color records
Signed-off-by: bxff <51504045+bxff@users.noreply.github.com>
chance.color() can output all valid CSS
values for colors, including rgba() syntax and predefined color
names. Due to the usage of hex2rgb and other methods, this can
break the editor. This commit ensures that all randomly generated
colors are specified in hex format.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Only the OAuth2 auth strategy was using the state parameter,
which should be used as described in the RFC. The other
auth strategies such as GitHub, GitLab or Google were lacking
the state parameter.
This change adds the required state parameter as well as
enabling PKCE support on providers where it's possible.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously, the user token was only used for the endpoint
to delete the user itself. This commit adds that token to
the history deletion as well.
Signed-off-by: Philip Molares <philip.molares@udo.edu>
This commit upgrades dependencies that are more or less trivial
to update, e.g. because they didn't have major version bumps or
simply didn't break anything. There are some dependencies which
have not been upgraded since this would have required larger
refactorings. This includes especially the markdown-it ecosystem
and the webpack ecosystem.
The largest refactorings in this commit come from the bump of
socket.io v2 to v4 which changed the handling of the connected
socket list for instance.
This commit further removes some outdated and/or unnecessary
dependencies. This includes the String.js library which is
unmaintained for 9 years and has some CVEs. We mainly used
this library for their escapeHTML and unescapeHTML methods.
This can be done using native DOM APIs nowadays, which is also
considered more safe since it is the same logic that the
browser itself uses.
Since we target Node 18 and above, we can also rely on the
built-in fetch function instead of the node-fetch package.
The current version of Chance.js includes a method for
generating a random color now too, so we don't need the
package randomcolor anymore.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
shortid is deprecated and they recommend nanoid instead.
We're not sure if this has to do with possible name
collisions or enumerability, but to be sure and on the
safe side, we're changing this. nanoid seems quite safe
since it uses node's crypto module underneath.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
Previously, image uploads were always allowed, unless `CMD_ALLOW_ANONYMOUS=false` and `CMD_ALLOW_ANONYMOUS_EDITS=false`.
This PR adds a new config option `CMD_ENABLE_UPLOADS` to configure image uploads independently. There are three different modes: `all` (everyone can upload, guests too), `registered` (only registered and logged-in users can upload images), and `none` to completely disable image uploads.
The default value is non-breaking as it is `all`, unless the config `CMD_ALLOW_ANONYMOUS=false` and `CMD_ALLOW_ANONYMOUS_EDITS=false` is set, in which case the value is `registered`.
The UI will reflect the setting and either show or hide the upload button.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
If running with an orchestrator that restarts hedgedoc on failing
healthchecks, this causes it to enter a crashloop.
toobusy -> gets restarted -> everyone refreshes -> toobusy
Signed-off-by: Daniel Koschützki <daniel.koschuetzki@adfinis.com>
The slideshare integration was broken for quite a while already,
as slideshare doesn't seem to have a good replacement, we're
dropping it in the same manner as speakerdeck was dropped some
time ago. This means the special syntax now just renders a plain
link. This commit gets rid of the vimdo oembed API too which
allowed JSONP injection. Instead we're using the normal vimeo
video metadata API.
Co-authored-by: Philip Molares <philip.molares@udo.edu>
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
The used library gist-embed relies on GitHub Gist's JSONP
endpoint which is a risk for XSS injection. By adding untrusted
content from GitHub into the DOM it also follows very bad
practises. Using the iframe embedding has the disadvantage of
not having the proper height for the frame auto-loaded, but
the security benefits are worth it.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
MySQLs string comparisons are case-insensitive by default.
This allows to hide notes by creating a new note with an alias that
equals the lower-cased alias of another note.
The new note is returned first by MySQL, so the original one is not
accessible anymore.
This fixes the problem by using an explicit binary comparison in the
affected queries.
See https://dev.mysql.com/doc/refman/8.0/en/case-sensitivity.html
Signed-off-by: David Mehren <git@herrmehren.de>
A change in the minio JS SDK resulted in uploads being stored
with a defect metadata object in minio, resulting in all
files served as application/octet-stream. This was caused as
the fifth argument to putObject is a metadata object and not
the content-type alone anymore.
Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This patch adds a try-catch around the rolesClaim extraction to prevent
full crashes of HedgeDoc when a user profile is read, that doesn't
contain any such claim, which can happen with some IdPs, like Keycloak,
that omit the attribute when it's empty.
As a result an authorized user would crash the entire server, which is
definitely unintended behaviour. The simply try-catch should resolve the
issue and make sure that roles is always defined even if the
`extractProfileAttribute` call fails.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
