ce88ed6841
Route all server-initiated outbound HTTP through one SSRF-protected layer: - Resolve each host once, validate every resolved address (private, loopback, link-local, CGNAT 100.64/10, multicast, reserved, unspecified, IPv4-mapped IPv6), and reject if any is unsafe. - Pin the connection to the validated address via curl's RESOLVE option so curl cannot re-resolve to a rebound IP (closes the validate-then-connect TOCTOU). Uses getaddrinfo so IPv6 records are checked too. - Add a sync SafeTransport and safehttp.post, and move the webhook and recipe-action paths off raw requests.post so they are guarded like the scraper. - Add HTTP_ALLOW_LIST / HTTP_DISALLOW_LIST settings (deny > allow > default) so operators can reach an internal server or block extra hosts. Apprise notifications egress through the third-party library and are not covered here.
Mealie
A Place For All Your Recipes
Explore the docs »
View Demo
·
Report Bug
·
GitHub Container Registry
About The Project
Mealie is a self hosted recipe manager, meal planner and shopping list with a RestAPI backend and a reactive frontend built in Vue for a pleasant user experience for the whole family. Easily add recipes into your database by providing the URL and Mealie will automatically import the relevant data, or add a family recipe with the UI editor. Mealie also provides an API for interactions from 3rd party applications.
Key Features
- Recipe imports: Create recipes, by importing from a URL or entering data manually
- Meal Planner: Use the Meal Planner to plan your what you'll cook for the next week
- Shopping List: Put the necessary ingredients on your Shopping List, organised into sections of your local supermarket
- Cookbooks: Group recipes into Cookbooks based on your own criteria
- Docker: Easy Docker deployment
- Localisation: Translations for 35+ languages
Contributing
Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated. If you're going to be working on the code-base, you'll want to use the nightly documentation to ensure you get the latest information.
- See the Contributors Guide for help getting started.
- We use VSCode Dev Containers to make it easy for contributors to get started!
If you are not a coder, you can still contribute financially. Financial contributions help me prioritize working on this project over others and helps me know that there is a real demand for project development.
Translations
Translations can be a great way for non-coders to contribute to the project. We use Crowdin to allow several contributors to work on translating Mealie. You can simply help by voting for your preferred translations, or even by completely translating Mealie into a new language.
For more information, check out the translation page on the contributor's guide.
License
Distributed under the AGPL License. See LICENSE for more information.
Sponsors
Huge thanks to all the sponsors of this project on Github Sponsors and Buy Me a Coffee. Without you, this project would surely not be possible.
Thanks to Depot for providing build instances for our Docker image builds.
