From 5f7942faca06e844996cbaa0c342fc39d9bc121d Mon Sep 17 00:00:00 2001 From: Xe Iaso Date: Fri, 21 Mar 2025 17:20:17 -0400 Subject: cmd/anubis: delete example RSS reader rule (#67) The example/default bot policy document had a rule to allow RSS readers through based on paths that end with ".rss", ".xml", ".atom", or ".json". Frameworks like Rails will treat these specially, meaning that going to /things/12345-whateverhaha.json could bypass Anubis. I checked the history of this rule and it was present in the original example policy file in Xe/x. This rule is likely a mistake and it has been removed. I think it was for making my blog still work with RSS readers. Thanks to Graham Sutherland for reporting this over email. Signed-off-by: Xe Iaso --- docs/docs/CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'docs') diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md index 56190b3..8c59f7d 100644 --- a/docs/docs/CHANGELOG.md +++ b/docs/docs/CHANGELOG.md @@ -11,6 +11,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## v1.14.2 + +Livia sas Junius: Echo 2 + +- Remove default RSS reader rule as it may allow for a targeted attack against rails apps + [#67](https://github.com/TecharoHQ/anubis/pull/67) - Whitelist MojeekBot in botPolicies [#47](https://github.com/TecharoHQ/anubis/issues/47) ## v1.14.1 -- cgit v1.2.3