Miniflux 2.0.43
Release date:
Changes
Avoid XSS when opening a broken image due to unescaped ServerError in proxy handler (CVE-2023-27592)
Creating an RSS feed item with the inline description containing an
<img>
tag with asrcset
attribute pointing to an invalid URL likehttp:a<script>alert(1)</script>
, we can coerce the proxy handler into an error condition where the invalid URL is returned unescaped and in full.This results in JavaScript execution on the Miniflux instance as soon as the user is convinced to open the broken image.
Use
r.RemoteAddr
to check/metrics
endpoint network access (CVE-2023-27591)HTTP headers like
X-Forwarded-For
orX-Real-Ip
can be easily spoofed. As such, it cannot be used to test if the client IP is allowed.The recommendation is to use HTTP Basic authentication to protect the metrics endpoint, or run Miniflux behind a trusted reverse-proxy.
Add HTTP Basic authentication for
/metrics
endpointAdd proxy support for several media types
Parse feed categories from RSS, Atom and JSON feeds
Ignore empty link when discovering feeds
Disable CGO explicitly to make sure the binary is statically linked
Add CSS classes to differentiate between category/feed/entry view and icons
Add rewrite and scraper rules for
blog.cloudflare.com
Add
color-scheme
to themesAdd new keyboard shortcut to toggle open/close entry attachments section
Sanitizer: allow
id
attribute in<sup>
elementAdd Indonesian Language
Update translations
Update Docker Compose examples:
- Run the application in one command
- Bring back the health check condition to
depends_on
- Remove deprecated
version
element
Update scraping rules for
ilpost.it
Bump
github.com/PuerkitoBio/goquery
from1.8.0
to1.8.1
Bump
github.com/tdewolff/minify/v2
from2.12.4
to2.12.5
Bump
github.com/yuin/goldmark
from1.5.3
to1.5.4
Bump
golang.org/x/*
dependencies
Attachments
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-darwin-amd64
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-darwin-arm64
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-freebsd-amd64
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-linux-amd64
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-linux-arm64
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-linux-armv5
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-linux-armv6
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-linux-armv7
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-openbsd-amd64
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-windows-amd64
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux-2.0.43-1.0.x86_64.rpm
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux_2.0.43_amd64.deb
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux_2.0.43_arm64.deb
- https://github.com/miniflux/v2/releases/download/2.0.43/miniflux_2.0.43_armhf.deb