0 releases 36 tags

RSS feed

• v1.7.5 1201cbd82b

  Compare

  security: fix open redirect and add small hardening (#1227)

  Ghost released this 2026-04-29 19:14:00 -04:00 | 126 commits to main since this release

  What this does

  Fixes an open redirect plus a handful of small, mostly-invisible
  hardening changes around it.

  What's in it

  • The fix: trailing-slash redirects no longer let //evil.com/
    redirect off-host.
  • SSRF block on the DNS/HTTP namespace verification — refuses to
    dial loopback, RFC1918, link-local, multicast, CGNAT, or
    IP-literal/single-label "domains".
  • Slow-client guard: ReadTimeout and IdleTimeout on the HTTP
    server (no WriteTimeout — would risk cutting off legitimate
    multi-package publishes).
  • Defence-in-depth headers on the UI (/) and 404 responses.
  • 5xx responses stop leaking raw DB error text to clients (logged
    server-side instead).
  • Search filter stops treating % and _ as wildcards.
  • Validators: PyPI/NuGet identifiers URL-escaped before fetching;
    MCPB no longer follows redirects.
  • Misc: Version field bounded to 255 chars; logs quote user input;
    BlockedNamespaces denylist now catches subdomain claimants.

  Each change is its own commit so they can be reviewed (or reverted)
  independently.

  Test plan

  • CI green
  • Synthetic publish in staging for each package type (npm, pypi,
    nuget, oci, mcpb) — confirms validator changes don't regress
  • Quick browser check of / after deploy to confirm UI still loads
    with the new CSP
  • curl https://<host>//evil.com/ — confirm the open redirect is
    closed

  🤖 Generated with Claude Code

  ---

  Co-authored-by: Claude Opus 4.7 (1M context) noreply@anthropic.com

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download