hedgedoc/lib/models, branch cindy

Sanitize username and photo URL

2021-05-09T17:28:44+00:00

HedgeDoc displays the username and user photo at various places
by rendering the respective variables into an `ejs` template.
As the values are user-provided or generated from user-provided data,
it may be possible to inject unwanted HTML.

This commit sanitizes the username and photo URL by passing them
through the `xss` library.

Co-authored-by: Christoph (Sheogorath) Kern 
Signed-off-by: David Mehren

Remove unneeded polyfill

2021-04-26T15:05:20+00:00

This polyfill was added because node versions less than 10.5.0 didn't include scrypt support. As we now raised the minimum required version to 12.0.0, this polyfill isn't needed anymore.

Signed-off-by: Erik Michelson

Fix Relative Path Traversal Attack on note creation

2021-04-25T18:40:17+00:00

Impact
---

An attacker can read arbitrary `.md` files from the server's filesystem due to an [improper input validation](https://cwe.mitre.org/data/definitions/20.html), which results in the ability to perform a [relative path traversal](https://cwe.mitre.org/data/definitions/23.html).

CVSSv3 string: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

PoC / Quicktest
---

To verify if you are affected, you can try to open the following URL: `http://localhost:3000/..%2F..%2FREADME#` (replace `http://localhost:3000` with your instance's base-URL e.g. `https://demo.hedgedoc.org/..%2F..%2FREADME#`).
- If you see a README page being rendered, you run an affected version.

Analysis
---

The attack works due the fact that [the internal router, passes the url-encoded alias](https://github.com/hedgedoc/hedgedoc/blob/master/lib/web/note/router.js#L26) to the `noteController.showNote`-function. This function passes the input directly to [`findNote()`](https://github.com/hedgedoc/hedgedoc/blob/78a732abe691b496fa3692aa2add37f7344db1fa/lib/web/note/util.js#L10) utility function, that will pass it on the the [`parseNoteId()`](https://github.com/hedgedoc/hedgedoc/blob/78a732abe691b496fa3692aa2add37f7344db1fa/lib/models/note.js#L188-L258)-function, that tries to make sense out of the noteId/alias and check if a note already exists and if so, if a corresponding file on disk was updated.

If no note exists the [note creation-function is called](https://github.com/hedgedoc/hedgedoc/blob/78a732abe691b496fa3692aa2add37f7344db1fa/lib/models/note.js#L240-L245), which pass this unvalidated alias, with a `.md` appended, into a [`path.join()`-function](https://github.com/hedgedoc/hedgedoc/blob/78a732abe691b496fa3692aa2add37f7344db1fa/lib/models/note.js#L99) which is read from the filesystem in the follow up routine and provides the pre-filled content of the new note.

This allows an attacker to not only read arbitrary `.md` files from the filesystem, but also  observes changes to them.

The usefulness of this attack can be considered limited, since mainly markdown files are use the file-ending `.md` and all markdown files contained in the hedgedoc project, like the README, are public anyway. If other protections such as a chroot or container or proper file permissions are in place, this attack's usefulness is rather limited.

Workarounds
---
On a reverse-proxy level one can force a URL-decode, which will prevent this attack because the router will not accept such a path.

For more information
---

If you have any questions or comments about this advisory:
* Open an topic on [our community forum](https://community.hedgedoc.org)
* Join our [matrix room](https://chat.hedgedoc.org)

Advisory link
---

https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-p528-555r-pf87

Signed-off-by: Christoph (Sheogorath) Kern

Run database migrations automatically on startup

2021-02-27T20:33:05+00:00

This commit removes the need for separate migrations with the sequelize-cli
by running them with umzug on application startup.

This is a port of #384

Co-authored-by: Sheogorath 
Signed-off-by: David Mehren

Linter: Fix all lint errors

2021-02-15T11:15:14+00:00

Signed-off-by: Philip Molares

Fix note creation in FreeURL mode not using template

2021-02-01T23:38:54+00:00

As explained in #391, the previous note creation logic didn't handle the case "alias is set, but it's not a file on disk". The fix introduces a separate if-statement for this scenario at the cost of a doubled filesystem read access.

Co-Authored-By: @evanlinde
Signed-off-by: Erik Michelson

Replace CodiMD with HedgeDoc

2020-11-14T20:18:36+00:00

Signed-off-by: Erik Michelson 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: References in public/views

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Update links in README

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Update links in SECURITY.md

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Update links in LICENSE

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Update links in docs/configuration.md

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Update links in bin/setup

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: References in docs/guides

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: References in docs/dev

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: References in docs/guides/auth

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: References in docs/setup

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Update various links in code to the new GitHub org.

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: codiMDVersion.js is now hedgeDocVersion.js

Signed-off-by: David Mehren 
Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: References in docs/setup/yunohost

Signed-off-by: Tilman Vatteroth 

Rebrand to HedgeDoc: Add banner and logo

Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Update links in docs/guides/migrate-etherpad

Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Remove note in docs/guides/auth/github

Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Replace links in public/docs/features

Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Add todo placeholder in docs/history

Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Replace github link in public/views/index/body

Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Replace github link in README

Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Add logo to README

Signed-off-by: Tilman Vatteroth 

Rename to HedgeDoc: Add note about the renaming to the front page

Signed-off-by: Tilman Vatteroth 

Removed Travis from README.md and change CodiMD to HedgeDoc in some places

Signed-off-by: Yannick Bungers 

Some more renaming to HedgeDoc
- Fixed capitalization of HedgeDoc
- Added renaming for etherpad migration doc

Signed-off-by: Yannick Bungers 

Changed Repo name to hedgedoc

Signed-off-by: Yannick Bungers

Fixed meta parsing of lang-attribute for using it in the published-view

2020-07-04T01:37:19+00:00

Signed-off-by: Erik Michelson

Added customizable og-metadata to notes

2019-10-04T17:49:45+00:00

Signed-off-by: Erik Michelson

fix: upgrade sequelize to latest version to fix CVE

2019-06-10T22:41:50+00:00

Signed-off-by: BoHong Li