Follow

lol lmao just realized there's a glaring cache poisoning vulnerability in my refactored code

Easy to fix though, and would only be exploitable by a malicious Matrix homeserver affecting their own media, so no point. I was keying thumbnailed cache entries as $mxc-$crop-$widthx$height, but those are all characters that could be added to a (malicious) media id on the same homeserver

Sign in to participate in the conversation
Pixietown

Small server part of the pixie.town infrastructure. Registration is closed.