From 69f3e94f096c83c06b3c76562ff1a3087181a06f Mon Sep 17 00:00:00 2001 From: Anil Kulkarni Date: Sun, 19 May 2024 13:40:15 -0700 Subject: [PATCH 1/5] Fix environment variables When a bash array is read into a variable, the syntax must be read -r -a not read -ar This fixes ENTRYPOINT_SKIP_SCRIPTS as well as DOCKER_APP_ENSURE_OWNERSHIP_PATHS --- docker/shared/root/docker/entrypoint.d/01-permissions.sh | 2 +- docker/shared/root/docker/entrypoint.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/shared/root/docker/entrypoint.d/01-permissions.sh b/docker/shared/root/docker/entrypoint.d/01-permissions.sh index efff58110..dc9dc7591 100755 --- a/docker/shared/root/docker/entrypoint.d/01-permissions.sh +++ b/docker/shared/root/docker/entrypoint.d/01-permissions.sh @@ -17,7 +17,7 @@ run-as-current-user chown --verbose --recursive "${RUNTIME_UID}:${RUNTIME_GID}" : "${DOCKER_APP_ENSURE_OWNERSHIP_PATHS:=""}" declare -a ensure_ownership_paths=() -IFS=' ' read -ar ensure_ownership_paths <<<"${DOCKER_APP_ENSURE_OWNERSHIP_PATHS}" +IFS=' ' read -r -a ensure_ownership_paths <<<"${DOCKER_APP_ENSURE_OWNERSHIP_PATHS}" if [[ ${#ensure_ownership_paths[@]} == 0 ]]; then log-info "No paths has been configured for ownership fixes via [\$DOCKER_APP_ENSURE_OWNERSHIP_PATHS]." diff --git a/docker/shared/root/docker/entrypoint.sh b/docker/shared/root/docker/entrypoint.sh index 73f6a4f3e..055cf25d7 100755 --- a/docker/shared/root/docker/entrypoint.sh +++ b/docker/shared/root/docker/entrypoint.sh @@ -28,7 +28,7 @@ entrypoint-set-script-name "entrypoint.sh" # Convert ENTRYPOINT_SKIP_SCRIPTS into a native bash array for easier lookup declare -a skip_scripts # shellcheck disable=SC2034 -IFS=' ' read -ar skip_scripts <<< "$ENTRYPOINT_SKIP_SCRIPTS" +IFS=' ' read -r -a skip_scripts <<< "$ENTRYPOINT_SKIP_SCRIPTS" # Ensure the entrypoint root folder exists mkdir -p "${ENTRYPOINT_D_ROOT}" From 0d1354c6c950a47e97694a25f09e9206430dfd1b Mon Sep 17 00:00:00 2001 From: Anil Kulkarni Date: Sun, 19 May 2024 15:21:14 -0700 Subject: [PATCH 2/5] Fix parsing multiline variables The seen_dot_env_variables parser does not work correctly for multiline variables Instead, just use set -o allexport to perform the needed behavior in the template file --- .../root/docker/entrypoint.d/05-templating.sh | 6 +-- docker/shared/root/docker/helpers.sh | 37 +++++++++---------- 2 files changed, 19 insertions(+), 24 deletions(-) diff --git a/docker/shared/root/docker/entrypoint.d/05-templating.sh b/docker/shared/root/docker/entrypoint.d/05-templating.sh index 4d229b11c..e699778cf 100755 --- a/docker/shared/root/docker/entrypoint.d/05-templating.sh +++ b/docker/shared/root/docker/entrypoint.d/05-templating.sh @@ -16,12 +16,8 @@ entrypoint-set-script-name "$0" declare template_file relative_template_file_path output_file_dir # load all dot-env config files -load-config-files +load-and-export-config-files -# export all dot-env variables so they are available in templating -# -# shellcheck disable=SC2068 -export ${seen_dot_env_variables[@]} find "${ENTRYPOINT_TEMPLATE_DIR}" -follow -type f -print | while read -r template_file; do # Example: template_file=/docker/templates/usr/local/etc/php/php.ini diff --git a/docker/shared/root/docker/helpers.sh b/docker/shared/root/docker/helpers.sh index 8ca2880fd..631b0ef0e 100644 --- a/docker/shared/root/docker/helpers.sh +++ b/docker/shared/root/docker/helpers.sh @@ -27,9 +27,6 @@ declare -a dot_env_files=( /var/www/.env ) -# environment keys seen when source dot files (so we can [export] them) -declare -ga seen_dot_env_variables=() - declare -g docker_state_path docker_state_path="$(readlink -f ./storage/docker)" @@ -250,13 +247,23 @@ function log-info-stderr() fi } -# @description Loads the dot-env files used by Docker and track the keys present in the configuration. -# @sets seen_dot_env_variables array List of config keys discovered during loading -function load-config-files() -{ - # Associative array (aka map/dictionary) holding the unique keys found in dot-env files - local -A _tmp_dot_env_keys +# @description Loads the dot-env files used by Docker +function load-config-files() { + local export_vars=0 + load-config-files-impl "$export_vars" +} +# @description Loads the dot-env files used by Docker and exports the variables to subshells +function load-and-export-config-files() { + local export_vars=1 + load-config-files-impl "$export_vars" +} + +# @description Implementation of the [load-config-files] and [load-and-export-config-files] functions. Loads th +# @arg $1 int Whether to export the variables or just have them available in the current shell +function load-config-files-impl() +{ + local export_vars=${1:-0} for file in "${dot_env_files[@]}"; do if ! file-exists "${file}"; then log-warning "Could not source file [${file}]: does not exists" @@ -264,19 +271,11 @@ function load-config-files() fi log-info "Sourcing ${file}" + if ((export_vars)); then set -o allexport; fi # shellcheck disable=SC1090 source "${file}" - - # find all keys in the dot-env file and store them in our temp associative array - for k in $(grep -v '^#' "${file}" | cut -d"=" -f1 | xargs); do - _tmp_dot_env_keys[$k]=1 - done + if ((export_vars)); then set +o allexport; fi done - - # Used in other scripts (like templating) for [export]-ing the values - # - # shellcheck disable=SC2034 - seen_dot_env_variables=("${!_tmp_dot_env_keys[@]}") } # @description Checks if $needle exists in $haystack From 8d51ed20373841bf277101e382fba61012b16b5a Mon Sep 17 00:00:00 2001 From: Anil Kulkarni Date: Sun, 19 May 2024 17:38:03 -0700 Subject: [PATCH 3/5] Modify the www-data user and group id to match the RUNTIME_UID/GID --- Dockerfile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Dockerfile b/Dockerfile index a0eda3227..ff8c9e24b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -132,6 +132,10 @@ ENV DEBIAN_FRONTEND="noninteractive" # Ensure we run all scripts through 'bash' rather than 'sh' SHELL ["/bin/bash", "-c"] +# Set www-data to be RUNTIME_UID/RUNTIME_GID +RUN groupmod --gid ${RUNTIME_GID} www-data \ + && usermod --uid ${RUNTIME_UID} --gid ${RUNTIME_GID} www-data + RUN set -ex \ && mkdir -pv /var/www/ \ && chown -R ${RUNTIME_UID}:${RUNTIME_GID} /var/www From ad30498dbc3f667b1db73a9262d0520277056ccf Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Thu, 23 May 2024 00:00:59 -0600 Subject: [PATCH 4/5] Lint --- app/Http/Controllers/FederationController.php | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/app/Http/Controllers/FederationController.php b/app/Http/Controllers/FederationController.php index 9155e9aed..5738292f1 100644 --- a/app/Http/Controllers/FederationController.php +++ b/app/Http/Controllers/FederationController.php @@ -72,14 +72,14 @@ class FederationController extends Controller return response()->json($res, 200, [], JSON_UNESCAPED_SLASHES); } - if(str_starts_with($resource, 'https://')) { - if(str_starts_with($resource, 'https://' . $domain . '/users/')) { - $username = str_replace('https://' . $domain . '/users/', '', $resource); - if(strlen($username) > 15) { + if (str_starts_with($resource, 'https://')) { + if (str_starts_with($resource, 'https://'.$domain.'/users/')) { + $username = str_replace('https://'.$domain.'/users/', '', $resource); + if (strlen($username) > 15) { return response('', 400); } $stripped = str_replace(['_', '.', '-'], '', $username); - if(!ctype_alnum($stripped)) { + if (! ctype_alnum($stripped)) { return response('', 400); } $key = 'federation:webfinger:sha256:url-username:'.$username; @@ -92,6 +92,7 @@ class FederationController extends Controller } $webfinger = (new Webfinger($profile))->generate(); Cache::put($key, $webfinger, 1209600); + return response()->json($webfinger, 200, [], JSON_UNESCAPED_SLASHES) ->header('Access-Control-Allow-Origin', '*'); } else { From 951c33901056bcebf9ed773e504deefc87ac5b4b Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Fri, 24 May 2024 23:16:04 -0600 Subject: [PATCH 5/5] Update RestrictedNames, add intent --- app/Util/Lexer/RestrictedNames.php | 730 +++++++++++++++-------------- 1 file changed, 366 insertions(+), 364 deletions(-) diff --git a/app/Util/Lexer/RestrictedNames.php b/app/Util/Lexer/RestrictedNames.php index 4224ae96c..9d88b0da1 100644 --- a/app/Util/Lexer/RestrictedNames.php +++ b/app/Util/Lexer/RestrictedNames.php @@ -4,376 +4,378 @@ namespace App\Util\Lexer; class RestrictedNames { - public static $additional = [ - 'autoconfig', - 'blog', - 'broadcasthost', - 'copyright', - 'download', - 'domainadmin', - 'domainadministrator', - 'errors', - 'events', - 'example', - 'faq', - 'faqs', - 'features', - 'ftp', - 'guest', - 'guests', - 'hostmaster', - 'hostmaster', - 'imap', - 'info', - 'information', - 'is', - 'isatap', - 'it', - 'localdomain', - 'localhost', - 'mail', - 'mailer-daemon', - 'mailerdaemon', - 'marketing', - 'me', - 'mis', - 'mx', - 'no-reply', - 'nobody', - 'noc', - 'noreply', - 'ns0', - 'ns1', - 'ns2', - 'ns3', - 'ns4', - 'ns5', - 'ns6', - 'ns7', - 'ns8', - 'ns9', - 'owner', - 'pop', - 'pop3', - 'postmaster', - 'pricing', - 'root', - 'sales', - 'security', - 'signin', - 'signout', - 'smtp', - 'src', - 'ssladmin', - 'ssladministrator', - 'sslwebmaster', - 'sys', - 'sysadmin', - 'system', - 'tutorial', - 'tutorials', - 'usenet', - 'uucp', - 'webmaster', - 'wpad', - ]; + public static $additional = [ + 'autoconfig', + 'blog', + 'broadcasthost', + 'copyright', + 'download', + 'domainadmin', + 'domainadministrator', + 'errors', + 'events', + 'example', + 'faq', + 'faqs', + 'features', + 'ftp', + 'guest', + 'guests', + 'hostmaster', + 'hostmaster', + 'imap', + 'info', + 'information', + 'is', + 'isatap', + 'it', + 'localdomain', + 'localhost', + 'mail', + 'mailer-daemon', + 'mailerdaemon', + 'marketing', + 'me', + 'mis', + 'mx', + 'no-reply', + 'nobody', + 'noc', + 'noreply', + 'ns0', + 'ns1', + 'ns2', + 'ns3', + 'ns4', + 'ns5', + 'ns6', + 'ns7', + 'ns8', + 'ns9', + 'owner', + 'pop', + 'pop3', + 'postmaster', + 'pricing', + 'root', + 'sales', + 'security', + 'signin', + 'signout', + 'smtp', + 'src', + 'ssladmin', + 'ssladministrator', + 'sslwebmaster', + 'sys', + 'sysadmin', + 'system', + 'tutorial', + 'tutorials', + 'usenet', + 'uucp', + 'webmaster', + 'wpad', + ]; - public static $reserved = [ - // Reserved for instance admin - 'admin', - 'administrator', + public static $reserved = [ + // Reserved for instance admin + 'admin', + 'administrator', - // Static Assets - 'assets', - 'public', - 'storage', - 'htaccess', - '.htaccess', - 'favicon.ico', - 'embed.js', - 'index.php', - 'manifest.json', - 'mix-manifest.json', - 'robots.txt', + // Static Assets + 'assets', + 'public', + 'storage', + 'htaccess', + '.htaccess', + 'favicon.ico', + 'embed.js', + 'index.php', + 'manifest.json', + 'mix-manifest.json', + 'robots.txt', - // Laravel Horizon - 'horizon', + // Laravel Horizon + 'horizon', - // Reserved routes - 'a', - 'app', - 'about', - 'aboutus', - 'about-us', - 'abuse', - 'actor', - 'actors', - 'account', - 'admins', - 'api', - 'audio', - 'auth', - 'avatar', - 'avatars', - 'b', - 'bartender', - 'broadcast', - 'broadcaster', - 'booth', - 'bouncer', - 'browse', - 'c', - 'cdn', - 'circle', - 'circles', - 'checkpoint', - 'collection', - 'collections', - 'community', - 'communities', - 'contact', - 'contact-us', - 'contact_us', - 'costar', - 'costars', - 'css', - 'd', - 'dashboard', - 'delete', - 'deleted', - 'deleting', - 'dmca', - 'db', - 'deck', - 'dev', - 'developer', - 'developers', - 'discover', - 'discovers', - 'dj', - 'doc', - 'docs', - 'docs', - 'drive', - 'drives', - 'driver', - 'e', - 'embed', - 'email', - 'emails', - 'emoji', - 'emojis', - 'error', - 'explore', - 'export', - 'exports', - 'external', - 'f', - 'fedi', - 'fediverse', - 'feed', - 'featured', - 'font', - 'fonts', - 'follow', - 'follows', - 'followme', - 'follow-me', - 'follow_me', - 'g', - 'go', - 'gdpr', - 'graph', - 'ghost', - 'ghosts', - 'global', - 'group', - 'groups', - 'h', - 'header', - 'headers', - 'home', - 'help', - 'helpcenter', - 'help-center', - 'help_center', - 'help_center_', - 'help-center-', - 'help-center_', - 'help_center-', - 'i', - 'instance', - 'inbox', - 'img', - 'imgs', - 'image', - 'images', - 'invite', - 'invites', - 'import', - 'imports', - 'j', - 'join', - 'js', - 'k', - 'key', - 'l', - 'lang', - 'language', - '_lang', - '_language', - 'lab', - 'labs', - 'legal', - 'link', - 'live', - 'look', - 'look-back', - 'loop', - 'loops', - 'location', - 'locations', - 'login', - 'logout', - 'm', - 'media', - 'mini', - 'micro', - 'menu', - 'music', - 'my2020', - 'my2021', - 'my2022', - 'my2023', - 'my2024', - 'my2025', - 'my2026', - 'my2027', - 'my2028', - 'my2029', - 'my2030', - 'my', - 'n', - 'news', - 'new', - 'news', - 'news', - 'newsfeed', - 'newsroom', - 'newsrooms', - 'news-room', - 'news-rooms', - 'network', - 'networks', - 'o', - 'oauth', - 'official', - 'p', - 'page', - 'pages', - 'pin', - 'pins', - 'photo', - 'photos', - 'password', - 'portfolio', - 'portfolios', - 'pre', - 'post', - 'privacy', - 'private', - 'q', - 'quote', - 'query', - 'r', - 'redirect', - 'redirects', - 'register', - 'registers', - 'review', - 'reviews', - 'reset', - 'report', - 'results', - 'reports', - 'robot', - 'robots', - 's', - 'sc', - 'search', - 'sell', - 'send', - 'settings', - 'short', - 'shortcode', - 'status', - 'statuses', - 'site', - 'sites', - 'stage', - 'static', - 'story', - 'stories', - 'support', - 'svg', - 'svgs', - 't', - 'terms', - 'telescope', - 'timeline', - 'timelines', - 'tour', - 'tv', - 'u', - 'user', - 'users', - 'username', - 'usernames', - 'v', - 'valet', - 'video', - 'videos', - 'vendor', - 'w', - 'waiter', - 'wall', - 'whats-new', - 'whatsnew', - 'whatnew', - 'whats-news', - 'web', - 'ws', - 'wss', - 'www', - 'x', - 'y', - 'year', - 'year-in-review', - 'z', - '400', - '401', - '403', - '404', - '500', - '503', - '504', - ]; + // Reserved routes + 'a', + 'app', + 'about', + 'aboutus', + 'about-us', + 'abuse', + 'actor', + 'actors', + 'account', + 'admins', + 'api', + 'audio', + 'auth', + 'avatar', + 'avatars', + 'b', + 'bartender', + 'broadcast', + 'broadcaster', + 'booth', + 'bouncer', + 'browse', + 'c', + 'cdn', + 'circle', + 'circles', + 'checkpoint', + 'collection', + 'collections', + 'community', + 'communities', + 'contact', + 'contact-us', + 'contact_us', + 'costar', + 'costars', + 'css', + 'd', + 'dashboard', + 'delete', + 'deleted', + 'deleting', + 'dmca', + 'db', + 'deck', + 'dev', + 'developer', + 'developers', + 'discover', + 'discovers', + 'dj', + 'doc', + 'docs', + 'docs', + 'drive', + 'drives', + 'driver', + 'e', + 'embed', + 'email', + 'emails', + 'emoji', + 'emojis', + 'error', + 'explore', + 'export', + 'exports', + 'external', + 'f', + 'fedi', + 'fediverse', + 'feed', + 'featured', + 'font', + 'fonts', + 'follow', + 'follows', + 'followme', + 'follow-me', + 'follow_me', + 'g', + 'go', + 'gdpr', + 'graph', + 'ghost', + 'ghosts', + 'global', + 'group', + 'groups', + 'h', + 'header', + 'headers', + 'home', + 'help', + 'help.center', + 'helpcenter', + 'help-center', + 'help_center', + 'help_center_', + 'help-center-', + 'help-center_', + 'help_center-', + 'i', + 'instance', + 'inbox', + 'img', + 'imgs', + 'image', + 'images', + 'invite', + 'invites', + 'import', + 'imports', + 'intent', + 'j', + 'join', + 'js', + 'k', + 'key', + 'l', + 'lang', + 'language', + '_lang', + '_language', + 'lab', + 'labs', + 'legal', + 'link', + 'live', + 'look', + 'look-back', + 'loop', + 'loops', + 'location', + 'locations', + 'login', + 'logout', + 'm', + 'media', + 'mini', + 'micro', + 'menu', + 'music', + 'my2020', + 'my2021', + 'my2022', + 'my2023', + 'my2024', + 'my2025', + 'my2026', + 'my2027', + 'my2028', + 'my2029', + 'my2030', + 'my', + 'n', + 'news', + 'new', + 'news', + 'news', + 'newsfeed', + 'newsroom', + 'newsrooms', + 'news-room', + 'news-rooms', + 'network', + 'networks', + 'o', + 'oauth', + 'official', + 'p', + 'page', + 'pages', + 'pin', + 'pins', + 'photo', + 'photos', + 'password', + 'portfolio', + 'portfolios', + 'pre', + 'post', + 'privacy', + 'private', + 'q', + 'quote', + 'query', + 'r', + 'redirect', + 'redirects', + 'register', + 'registers', + 'review', + 'reviews', + 'reset', + 'report', + 'results', + 'reports', + 'robot', + 'robots', + 's', + 'sc', + 'search', + 'sell', + 'send', + 'settings', + 'short', + 'shortcode', + 'status', + 'statuses', + 'site', + 'sites', + 'stage', + 'static', + 'story', + 'stories', + 'support', + 'svg', + 'svgs', + 't', + 'terms', + 'telescope', + 'timeline', + 'timelines', + 'tour', + 'tv', + 'u', + 'user', + 'users', + 'username', + 'usernames', + 'v', + 'valet', + 'video', + 'videos', + 'vendor', + 'w', + 'waiter', + 'wall', + 'whats-new', + 'whatsnew', + 'whatnew', + 'whats-news', + 'web', + 'ws', + 'wss', + 'www', + 'x', + 'y', + 'year', + 'year-in-review', + 'z', + '400', + '401', + '403', + '404', + '500', + '503', + '504', + ]; - public static function get() - { - $banned = []; + public static function get() + { + $banned = []; - if(config('instance.username.banned')) { - $banned = array_map('trim', explode(',', config('instance.username.banned'))); - } + if (config('instance.username.banned')) { + $banned = array_map('trim', explode(',', config('instance.username.banned'))); + } - $additional = self::$additional; - $reserved = self::$reserved; + $additional = self::$additional; + $reserved = self::$reserved; - $res = array_merge($additional, $reserved, $banned); - $res = array_unique($res); - sort($res); - - return $res; - } + $res = array_merge($additional, $reserved, $banned); + $res = array_unique($res); + sort($res); + + return $res; + } }