Merge branch 'main' into immichIntegration

Author: slothful-vassal

CHANGELOG.md

@@ -1,7 +1,9 @@
-# [Unreleased]
+# 0.19.3
 
-## Features
-- Server-side map clustering and zoom-aware polyline filtering: The world map now performs trail clustering on the server to improve performance. At lower zoom levels, smaller trails are clustered, while at higher zoom levels the largest routes in the current view are shown as detailed polylines. The maximum number of simultaneously visible polylines can be configured via the PUBLIC_MAP_MAX_POLYLINES environment variable.
+## Security
+- Fixed unauthenticated IDOR on `GET /activitypub/trail/{id}` and `GET /activitypub/comment/{id}` — private records are now access-checked before being returned. (GHSA-9qg7-jr2x-prvh, reported by [@de3erve-hunter](https://github.com/de3erve-hunter))
+- Fixed stored XSS via `waypoint.icon` in map markers — the icon value is now validated against an allowlist before being passed to `insertAdjacentHTML`. (GHSA-hx3v-rv4v-w875, reported by [@de3erve-hunter](https://github.com/de3erve-hunter))
+- Fixed stored XSS via `waypoint.name` and `waypoint.icon` in the elevation profile — replaced unsafe `innerHTML` assignment with safe DOM construction. (GHSA-m7v2-6gj3-3g2p, reported by [@de3erve-hunter](https://github.com/de3erve-hunter))
 
 # v0.19.2
 ## Documentation

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities through [GitHub Private Advisories](https://github.com/open-wanderer/wanderer/security/advisories/new). Do not open a public issue.
+
+We will acknowledge your report within 72 hours and aim to release a fix within **60 days**. If we need more time we will let you know. We will credit you in the advisory and changelog when the fix is published.
+
+## Scope
+
+**In scope:**
+- Vulnerabilities in this codebase that would affect any self-hosted Wanderer instance
+
+**Out of scope:**
+- `wanderer.to` and any other publicly hosted instances — do not test against servers you do not own or operate
+- Vulnerabilities in third-party dependencies — please report those upstream
+- Theoretical issues without a working proof of concept
+
+## Supported Versions
+
+Only the latest release receives security fixes. We do not backport patches to older versions.

db/routes/activitypub.go

@@ -183,9 +183,18 @@ func ActivitypubTrail(e *core.RequestEvent) error {
 	id := e.Request.PathValue("id")
 
 	trail, err := e.App.FindRecordById("trails", id)
+	if err != nil {
+		return e.NotFoundError("trail not found", nil)
+	}
+
+	reqInfo, err := e.RequestInfo()
 	if err != nil {
 		return err
 	}
+	canAccess, err := e.App.CanAccessRecord(trail, reqInfo, trail.Collection().ViewRule)
+	if err != nil || !canAccess {
+		return e.NotFoundError("trail not found", nil)
+	}
 
 	trailObject, err := util.ObjectFromTrail(e.App, trail, nil)
 	if err != nil {
@@ -198,9 +207,18 @@ func ActivitypubComment(e *core.RequestEvent) error {
 	id := e.Request.PathValue("id")
 
 	comment, err := e.App.FindRecordById("comments", id)
+	if err != nil {
+		return e.NotFoundError("comment not found", nil)
+	}
+
+	reqInfo, err := e.RequestInfo()
 	if err != nil {
 		return err
 	}
+	canAccess, err := e.App.CanAccessRecord(comment, reqInfo, comment.Collection().ViewRule)
+	if err != nil || !canAccess {
+		return e.NotFoundError("comment not found", nil)
+	}
 
 	commentObject, err := util.ObjectFromComment(e.App, comment, nil)
 	if err != nil {

docs/package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "docs",
   "type": "module",
-  "version": "0.19.2",
+  "version": "0.19.3",
   "scripts": {
     "dev": "astro dev",
     "start": "astro dev",

docs/package.json

@@ -2,6 +2,13 @@
 title: Changelog
 description: What changed in the last patch?
 ---
+## v0.19.3
+
+### Security
+- Fixed unauthenticated IDOR on `GET /activitypub/trail/{id}` and `GET /activitypub/comment/{id}` — private records are now access-checked before being returned. (GHSA-9qg7-jr2x-prvh, reported by [@de3erve-hunter](https://github.com/de3erve-hunter))
+- Fixed stored XSS via `waypoint.icon` in map markers — the icon value is now validated against an allowlist before being passed to `insertAdjacentHTML`. (GHSA-hx3v-rv4v-w875, reported by [@de3erve-hunter](https://github.com/de3erve-hunter))
+- Fixed stored XSS via `waypoint.name` and `waypoint.icon` in the elevation profile — replaced unsafe `innerHTML` assignment with safe DOM construction. (GHSA-m7v2-6gj3-3g2p, reported by [@de3erve-hunter](https://github.com/de3erve-hunter))
+
 ## v0.19.2
 ### Documentation
 -  Add CONTRIBUTING guidelines

docs/src/content/docs/changelog.md

@@ -1,6 +1,6 @@
 {
   "name": "wanderer",
-  "version": "0.19.2",
+  "version": "0.19.3",
   "private": true,
   "scripts": {
     "dev": "vite dev",

web/package-lock.json

@@ -43,9 +43,10 @@ export function syncMarkerHighlightClass(
 }
 
 export function createMarkerFromWaypoint(waypoint: Waypoint, onDragEnd?: (marker: M.Marker, wpId?: string) => void): FontawesomeMarker {
+    const safeMarkerIcon = waypoint.icon && icons.includes(waypoint.icon) ? waypoint.icon : "circle";
     const marker = new FontawesomeMarker({
         id: waypoint.id,
-        icon: `fa fa-${waypoint.icon}`,
+        icon: `fa fa-${safeMarkerIcon}`,
     }, {
         draggable: onDragEnd !== undefined,
         color: "#6b7280"

web/package.json

@@ -707,7 +707,14 @@ export class ElevationProfile {
                             wpDiv.style.top = `8px`; // Position horizontally
 
                             // Add custom HTML content (e.g., icon + label)
-                            wpDiv.innerHTML = `<div class="tooltip" data-title="${this.waypoints[index]?.name ?? "?"}"><i class="fa fa-${this.waypoints.at(index)?.icon ?? 'circle'}"></i></div>`;
+                            const tooltipDiv = document.createElement("div");
+                            tooltipDiv.className = "tooltip";
+                            tooltipDiv.dataset.title = this.waypoints[index]?.name ?? "?";
+                            const iconEl = document.createElement("i");
+                            const safeIcon = this.waypoints.at(index)?.icon ?? "circle";
+                            iconEl.className = `fa fa-${/^[a-z0-9-]+$/.test(safeIcon) ? safeIcon : "circle"}`;
+                            tooltipDiv.appendChild(iconEl);
+                            wpDiv.appendChild(tooltipDiv);
 
                             waypointContainer.appendChild(wpDiv); // Add to container
                         });