Mirrors/mealie
1
0
Fork 0
mirror of https://github.com/mealie-recipes/mealie.git synced 2026-07-25 00:50:14 -04:00
Code Issues Packages Projects Releases Wiki Activity
5,100 Commits 10 Branches 99 Tags
fix/harden-outbound-http-ssrf
Commit Graph

198 Commits

Author SHA1 Message Date
Hayden
ce88ed6841 fix: harden server-initiated HTTP against SSRF and DNS rebinding 
Route all server-initiated outbound HTTP through one SSRF-protected layer:

- Resolve each host once, validate every resolved address (private,
  loopback, link-local, CGNAT 100.64/10, multicast, reserved, unspecified,
  IPv4-mapped IPv6), and reject if any is unsafe.
- Pin the connection to the validated address via curl's RESOLVE option so
  curl cannot re-resolve to a rebound IP (closes the validate-then-connect
  TOCTOU). Uses getaddrinfo so IPv6 records are checked too.
- Add a sync SafeTransport and safehttp.post, and move the webhook and
  recipe-action paths off raw requests.post so they are guarded like the
  scraper.
- Add HTTP_ALLOW_LIST / HTTP_DISALLOW_LIST settings (deny > allow > default)
  so operators can reach an internal server or block extra hosts.

Apprise notifications egress through the third-party library and are not
covered here.
 2026-07-19 21:41:30 -05:00
TowyTowy
95277e0e6b fix: truncate scraped recipe slug to filesystem-safe length (#7862) 
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-07-17 18:37:19 +00:00
Michael Genson
ac0bb4fb2c fix: Upgrade pytest-asyncio (#7746) 2026-06-09 16:09:35 -05:00
Hayden
2d8b74282a fix: harden recipe content against stored XSS (chips, instructions, asset media) (#7719) 2026-05-31 16:14:16 +00:00
Michael Genson
396fcd5ee4 fix: Ensure secret key is not empty (#7701) 2026-05-28 23:09:31 -05:00
Michael Genson
c3f87736d0 feat: In-app AI Provider Configuration (#7650) 2026-05-23 11:13:10 -05:00
Michael Genson
642c826f2b fix: Protect sensitive data in query filter API (GHSA-8m57-7cv5-rjp8) (#7629) 
Co-authored-by: Hayden <64056131+hay-kot@users.noreply.github.com>
 2026-05-21 21:08:41 +00:00
Michael Genson
d340fdd9df fix: Update backend normalization to match search normalization logic (#7603) 
Co-authored-by: Copilot <copilot@github.com>
 2026-05-10 21:23:57 -05:00
harshitlarl
c029a639fb fix: preserve stored recipe slugs during hydration (#7294) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
Co-authored-by: Michael Genson <genson.michael@gmail.com>
 2026-03-27 10:08:48 -05:00
Sebastian
449e3baa07 fix: restore recipe notes during JSON import (#7017) 
Co-authored-by: Michael Genson <genson.michael@gmail.com>
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
 2026-03-26 15:04:59 -05:00
Sim
26924ab054 fix: #6802 prevent 500 internal server error when patching recipe tags (#6803) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
Co-authored-by: Michael Genson <genson.michael@gmail.com>
 2026-03-18 13:45:51 -05:00
Aurelien
1344f1674d feat: Add social media video import (YouTube, TikTok, Instagram) (#6764) 
Co-authored-by: Maxime Louward <61564950+mlouward@users.noreply.github.com>
Co-authored-by: Michael Genson <genson.michael@gmail.com>
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
 2026-03-09 15:44:27 -05:00
Michael Genson
b5c089f58c feat: Unit standardization / conversion (#7121) 2026-03-09 17:13:41 +00:00
Michael Genson
77081d0482 feat: include extra ingredients + amounts in NLP parser output (#7191) 2026-03-05 16:28:14 -06:00
Michael Genson
b182b50faa fix(deps): update dependency fastapi to v0.133.1 (#7146) 2026-02-25 15:56:01 -06:00
Michael Genson
216ae8571c fix: Include unmade recipes when filtering by last made (#7130) 2026-02-23 18:34:16 -06:00
Michael Genson
29c6176d89 docs: Remove redoc API generation (#7109) 2026-02-20 20:49:43 +00:00
Michael Genson
23c7bd7e3d feat: Customize Ingredient Plural Handling (#7057) 2026-02-12 19:07:23 -06:00
Michael Genson
b64f14aaae feat: Dynamic Placeholders UI (#7034) 2026-02-11 05:43:17 +00:00
Joey
f2cc8dc922 fix: handle numeric recipeCategory from LLM/site to prevent import failure (#7026) 2026-02-07 19:47:44 +00:00
Michael Genson
fb8e318739 fix: Flaky $NOW tests (#6990) 2026-02-02 11:24:13 -06:00
Michael Genson
987c7209fc feat: Query relative dates (#6984) 2026-02-01 21:36:46 -06:00
Michael Genson
570d6f1433 feat: Migrate OpenAI implementation to use structured outputs (#6964) 2026-01-31 11:57:05 -06:00
Imanuel
c7ae67e7cd feat: Customizable OpenAI prompts (#5146) (#6588) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
Co-authored-by: Michael Genson <genson.michael@gmail.com>
 2026-01-30 12:00:03 -06:00
Michael Genson
706d4ee0b5 fix: Coerce null servings into 0 servings (#6839) 2026-01-05 17:49:34 -06:00
Michael Genson
d02023e12c fix: Only fetch recipes with a household id (#6773) 2025-12-23 16:48:27 -06:00
onemustpersist
8b4111d68f fix: Imported API keys not working on a new server #6477 (#6496) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
Co-authored-by: Michael Genson <genson.michael@gmail.com>
 2025-12-22 12:08:44 -06:00
Aurelien
7b32508201 fix: the add_pagination_to_query now always returns the correct count (#6505) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
 2025-12-22 10:39:35 -06:00
Michael Genson
6f03010f6c fix: Security Patches (#6743) 2025-12-18 22:54:16 +00:00
Michael Genson
bdbef1ab9e fix: More lenient postgres override parsing (#6712) 2025-12-13 14:21:54 -06:00
Michael Genson
ff42964537 fix: Brute parser fails if unit or food is empty (#6500) 2025-11-03 23:44:13 -06:00
Michael Genson
b7b191a5ee fix: Truncate Long Passwords (>72 bytes) (#6335) 2025-10-09 23:46:06 +00:00
Michael Genson
a9090bc2bd feat: Manually calculate OpenAI Parsing Confidence (#6141) 2025-09-19 23:09:34 -05:00
Michael Genson
d4f4ba0c8d fix: Ingredient Parser Drops Units Sometimes (#6150) 2025-09-13 15:49:08 -05:00
Xavier L.
6d2936cab6 fix: Handle missing OIDC groups claim (#6054) 2025-08-29 21:07:00 +00:00
Michael Genson
42eef17cfb fix: Make String Cleaner More Robust (#6032) 2025-08-27 14:19:43 +00:00
Hristo Kapanakov
c91d216fe9 feat: Allow using OIDC auth cache instead of session (#5746) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
 2025-08-15 09:43:29 +00:00
Michael Genson
481ce92d84 fix: CONTAINS ALL doesn't contain all (#5900) 2025-08-14 12:21:40 +00:00
Skye Samuels
0b3fe2c8da fix: add confidence calculation for BruteForceParser (#5903) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
 2025-08-11 18:56:35 +00:00
Michael Genson
245ca5fe3b feat: Remove "Is Food" and "Disable Amounts" Flags (#5684) 
Co-authored-by: Kuchenpirat <24235032+Kuchenpirat@users.noreply.github.com>
 2025-07-31 17:36:24 +02:00
Hayden
da3271f33f chore: remove unused jinja export option (#5631) 2025-07-05 00:45:56 +00:00
Michael Genson
0f58ac5b47 fix: "NOT IN" doesn't apply filter properly (#5154) 2025-03-18 18:07:26 +00:00
Carter
d724f408cc feat: OIDC: Call userinfo if no claims found in id token (#5228) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
 2025-03-17 03:05:20 +00:00
Michael Genson
ad59e653da fix: Case Insensitive Query Filters (#5162) 2025-03-10 10:56:12 +00:00
Michael Genson
9a469fe4fd fix: Filter out null chars from OpenAI response (#5187) 2025-03-07 17:34:32 +01:00
Michael Genson
b12aea8272 feat: Migrate from CRF++ to Ingredient Parser (a Python package) (#5061) 2025-02-28 15:17:28 +01:00
Michael Genson
df8dd3fe4a fix: Invalidate Expired Shared Links (#5065) 2025-02-25 13:01:32 +00:00
Michael Genson
e9892aba89 feat: Move "on hand" and "last made" to household (#4616) 
Co-authored-by: Kuchenpirat <24235032+Kuchenpirat@users.noreply.github.com>
 2025-01-13 17:19:49 +01:00
renovate[bot]
2c2de1e95b chore(deps): update dependency ruff to ^0.9.0 (#4871) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
Co-authored-by: Kuchenpirat <24235032+Kuchenpirat@users.noreply.github.com>
 2025-01-13 15:43:55 +00:00
gpotter@gmail.com
795c2cf575 fix: Allow scraping calories as number (#4854) 
Co-authored-by: Kuchenpirat <24235032+Kuchenpirat@users.noreply.github.com>
 2025-01-07 15:55:59 +00:00