tarrien/Mastodon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge commit '82e477b184b5666fff7fb55933dce22ca2925db8' into glitch-soc/merge-upstream

Browse Source 
Conflicts:
- `db/migrate/20180831171112_create_bookmarks.rb`:
  Upstream ran a lint fix on this file, but this file is different in
  glitch-soc because the feature was added much earlier.
  Ran the lint fix on our own version of the file.
This commit is contained in:
Claire
2023-07-12 16:03:05 +02:00
parent ec95f62cb4 82e477b184
commit 9ae60f8738
458 changed files with 1117 additions and 853 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
config/application.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
require_relative 'boot'
require 'rails'
@@ -194,10 +196,10 @@ module Mastodon
config.to_prepare do
Doorkeeper::AuthorizationsController.layout 'modal'
Doorkeeper::AuthorizedApplicationsController.layout 'admin'
Doorkeeper::Application.send :include, ApplicationExtension
Doorkeeper::AccessToken.send :include, AccessTokenExtension
Devise::FailureApp.send :include, AbstractController::Callbacks
Devise::FailureApp.send :include, Localized
Doorkeeper::Application.include ApplicationExtension
Doorkeeper::AccessToken.include AccessTokenExtension
Devise::FailureApp.include AbstractController::Callbacks
Devise::FailureApp.include Localized
end
end
end

2
config/boot.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
unless ENV.key?('RAILS_ENV')
STDERR.puts 'ERROR: Missing RAILS_ENV environment variable, please set it to "production", "development", or "test".'
exit 1

46
config/brakeman.ignore
View File

@@ -23,29 +23,6 @@
],
"note": ""
},
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "30dfe36e87fe1b8f239df9a33d576e44a9863f73b680198d4713be6540ae61d3",
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/trends/query.rb",
"line": 76,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "klass.joins(\"join unnest(array[#{ids.join(\",\")}]) with ordinality as x (id, ordering) on #{klass.table_name}.id = x.id\")",
"render_path": null,
"location": {
"type": "method",
"class": "Trends::Query",
"method": "to_arel"
},
"user_input": "ids.join(\",\")",
"confidence": "Weak",
"cwe_id": [
89
],
"note": ""
},
{
"warning_type": "Cross-Site Scripting",
"warning_code": 2,
@@ -79,29 +56,6 @@
],
"note": ""
},
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "75fcd147b7611763ab6915faf8c5b0709e612b460f27c05c72d8b9bd0a6a77f8",
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "lib/mastodon/snowflake.rb",
"line": 87,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "connection.execute(\"CREATE OR REPLACE FUNCTION timestamp_id(table_name text)\\nRETURNS bigint AS\\n$$\\n DECLARE\\n time_part bigint;\\n sequence_base bigint;\\n tail bigint;\\n BEGIN\\n time_part := (\\n -- Get the time in milliseconds\\n ((date_part('epoch', now()) * 1000))::bigint\\n -- And shift it over two bytes\\n << 16);\\n\\n sequence_base := (\\n 'x' ||\\n -- Take the first two bytes (four hex characters)\\n substr(\\n -- Of the MD5 hash of the data we documented\\n md5(table_name || '#{SecureRandom.hex(16)}' || time_part::text),\\n 1, 4\\n )\\n -- And turn it into a bigint\\n )::bit(16)::bigint;\\n\\n -- Finally, add our sequence number to our base, and chop\\n -- it to the last two bytes\\n tail := (\\n (sequence_base + nextval(table_name || '_id_seq'))\\n & 65535);\\n\\n -- Return the time part and the sequence part. OR appears\\n -- faster here than addition, but they're equivalent:\\n -- time_part has no trailing two bytes, and tail is only\\n -- the last two bytes.\\n RETURN time_part | tail;\\n END\\n$$ LANGUAGE plpgsql VOLATILE;\\n\")",
"render_path": null,
"location": {
"type": "method",
"class": "Mastodon::Snowflake",
"method": "define_timestamp_id"
},
"user_input": "SecureRandom.hex(16)",
"confidence": "Medium",
"cwe_id": [
89
],
"note": ""
},
{
"warning_type": "Denial of Service",
"warning_code": 76,

2
config/environment.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Load the Rails application.
require_relative 'application'

2
config/environments/development.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
Rails.application.configure do
# Settings specified here will take precedence over those in config/application.rb.

2
config/environments/production.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
Rails.application.configure do
# Settings specified here will take precedence over those in config/application.rb.

2
config/environments/test.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
Rails.application.configure do
# Settings specified here will take precedence over those in config/application.rb.

2
config/initializers/0_post_deployment_migrations.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Post deployment migrations are included by default. This file must be loaded
# before other initializers as Rails may otherwise memoize a list of migrations
# excluding the post deployment migrations.

2
config/initializers/active_model_serializers.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
ActiveModelSerializers.config.tap do |config|
config.default_includes = '**'
end

1
config/initializers/application_controller_renderer.rb
View File

@@ -1,3 +1,4 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
# ActiveSupport::Reloader.to_prepare do

2
config/initializers/assets.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
# Version of your assets, change this if you want to expire all your assets.

2
config/initializers/backtrace_silencers.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
# You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces.

2
config/initializers/cache_logging.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Log cache errors with Rail's logger
# This used to be the default in old Rails versions: https://github.com/rails/rails/commit/7fcf8590e788cef8b64cc266f75931c418902ca9#diff-f0748f0be8a653eea13369ebb1cadabcad71ede7cfaf20282447e64329817befL86
Rails.cache.logger = Rails.logger

2
config/initializers/chewy.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
enabled = ENV['ES_ENABLED'] == 'true'
host = ENV.fetch('ES_HOST') { 'localhost' }
port = ENV.fetch('ES_PORT') { 9200 }

2
config/initializers/content_security_policy.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Define an application-wide content security policy
# For further information see the following documentation
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

2
config/initializers/cookies_serializer.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
# Specify a serializer for the signed and encrypted cookie jars.

2
config/initializers/cors.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
# Avoid CORS issues when API is called from the frontend app.

2
config/initializers/devise.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
require 'devise/strategies/authenticatable'
Warden::Manager.after_set_user except: :fetch do |user, warden|

2
config/initializers/doorkeeper.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
Doorkeeper.configure do
# Change the ORM that doorkeeper will use (needs plugins)
orm :active_record

2
config/initializers/fast_blank.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
if String.method_defined?(:blank_as?)
class String
alias blank? blank_as?

2
config/initializers/ffmpeg.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
if ENV['FFMPEG_BINARY'].present?
FFMPEG.ffmpeg_binary = ENV['FFMPEG_BINARY']
end

2
config/initializers/filter_parameter_logging.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
# Configure sensitive parameters which will be filtered from the log file.

2
config/initializers/http_client_proxy.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
Rails.application.configure do
config.x.http_client_proxy = {}

2
config/initializers/httplog.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
HttpLog.configure do |config|
config.logger = Rails.logger
config.color = { color: :yellow }

2
config/initializers/inflections.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
# Add new inflection rules using the following format. Inflections

2
config/initializers/mail_delivery_job.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
ActionMailer::MailDeliveryJob.class_eval do
discard_on ActiveJob::DeserializationError
end

2
config/initializers/mime_types.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
Mime::Type.register 'application/json', :json, %w(text/x-json application/jsonrequest application/jrd+json application/activity+json application/ld+json)

2
config/initializers/oj.rb
View File

@@ -1 +1,3 @@
# frozen_string_literal: true
Oj.default_options = { mode: :compat, time_format: :ruby, use_to_json: true }

2
config/initializers/omniauth.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
Rails.application.config.middleware.use OmniAuth::Builder do
# Vanilla omniauth strategies
end

2
config/initializers/open_uri_redirection.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
require 'open-uri'
module OpenURI

1
config/initializers/permissions_policy.rb
View File

@@ -1,3 +1,4 @@
# frozen_string_literal: true
# Define an application-wide HTTP permissions policy. For further
# information see https://developers.google.com/web/updates/2018/06/feature-policy
#

2
config/initializers/pghero.rb
View File

@@ -1 +1,3 @@
# frozen_string_literal: true
PgHero.show_migrations = Rails.env.development?

2
config/initializers/preload_link_headers.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Since Rails 6.1, ActionView adds preload links for javascript files
# in the Links header per default.

2
config/initializers/premailer_rails.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
require_relative '../../lib/mastodon/premailer_webpack_strategy'
Premailer::Rails.config.merge!(remove_ids: true,

4
config/initializers/rack_attack.rb
View File

@@ -5,9 +5,9 @@ require 'doorkeeper/grape/authorization_decorator'
class Rack::Attack
class Request
def authenticated_token
return @token if defined?(@token)
return @authenticated_token if defined?(@authenticated_token)
@token = Doorkeeper::OAuth::Token.authenticate(
@authenticated_token = Doorkeeper::OAuth::Token.authenticate(
Doorkeeper::Grape::AuthorizationDecorator.new(self),
*Doorkeeper.configuration.access_token_methods
)

2
config/initializers/rack_attack_logging.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
ActiveSupport::Notifications.subscribe(/rack_attack/) do |_name, _start, _finish, _request_id, payload|
req = payload[:request]

2
config/initializers/redis.rb
View File

@@ -1 +1,3 @@
# frozen_string_literal: true
Redis.sadd_returns_boolean = false

2
config/initializers/session_store.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
Rails.application.config.session_store :cookie_store,

2
config/initializers/simple_form.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Use this setup block to configure all options available in SimpleForm.
module AppendComponent

2
config/initializers/stoplight.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
require 'stoplight'
Rails.application.reloader.to_prepare do

2
config/initializers/trusted_proxies.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
module Rack
class Request
def trusted_proxy?(ip)

2
config/initializers/twitter_regex.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
module Twitter::TwitterText
class Configuration
def emoji_parsing_enabled

2
config/initializers/webauthn.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
WebAuthn.configure do |config|
# This value needs to match `window.location.origin` evaluated by
# the User Agent during registration and authentication ceremonies.

2
config/initializers/wrap_parameters.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
# Be sure to restart your server when you modify this file.
# This file contains settings for ActionController::ParamsWrapper which

2
config/locales/sr-Latn.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
require 'rails_i18n/common_pluralizations/romanian'
::RailsI18n::Pluralization::Romanian.with_locale(:'sr-Latn')

2
config/locales/sr.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
require 'rails_i18n/common_pluralizations/romanian'
::RailsI18n::Pluralization::Romanian.with_locale(:sr)

2
config/puma.rb
View File

@@ -1,3 +1,5 @@
# frozen_string_literal: true
persistent_timeout ENV.fetch('PERSISTENT_TIMEOUT') { 20 }.to_i
max_threads_count = ENV.fetch('MAX_THREADS') { 5 }.to_i