security: fix 10 vulnerabilities from security audit

- SSRF: block private/internal URLs in image cache fetch
- SSRF: block private/internal URLs in RSS feed fetch (scheme guard)
- SSRF: block private/internal URLs in CalDAV URL setting
- Auth: require login for GET /api/images/<id> (was unauthenticated)
- Auth: restrict Ollama model pull/delete to admin users only
- Info disclosure: remove email from /api/users/search response
- OAuth: skip email-based account linking when email_verified is false
- Config: raise hard error on default SECRET_KEY when SECURE_COOKIES=true
- Rate limit: document proxy header requirement; add startup warning
- XSS: remove src/alt from global DOMPurify ADD_ATTR allowlist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

Bryan Van Deusen

2026-03-29 00:37:13 -04:00

parent 024075329d

commit 00643c778e

15 changed files with 81 additions and 16 deletions

									
										frontend/src/utils/markdown.ts
									
		+1
		-1
	
												View File
												
				@@ -38,7 +38,7 @@ const headingRenderer = {

				marked.use({ renderer: headingRenderer });

				const PURIFY_OPTS_FULL = {

				  ADD_ATTR: ["data-tag", "data-title", "src", "alt"],

				  ADD_ATTR: ["data-tag", "data-title"],

				  FORCE_BODY: true,

				};