0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-04 10:39:43 +08:00
discourse/lib/freedom_patches
David Taylor a071880169
DEV: Sandbox all image processing via Landlock (#42048)
- Update all imagemagick calls to go through a new `::Imagemagick`
wrapper, which wraps the command in `Discourse::SafeExec`
- Patch image_optim to force its calls through `SafeExec`

This provides robust defense-in-depth against vulnerabilities in image
processing binaries. Landlock is supported on Linux Kernel 5.13 and
above.
2026-07-27 18:27:34 +01:00
..
active_record_attribute_methods.rb
active_record_disable_serialization.rb
ams_include_without_root.rb
copy_file.rb
cose_rsapkcs1.rb
fast_image.rb
final_destination_connect.rb FIX: Keep TCPServer.open(port) working with the Happy Eyeballs patch 2026-07-22 09:05:38 +02:00
image_optim_sandbox.rb DEV: Sandbox all image processing via Landlock (#42048) 2026-07-27 18:27:34 +01:00
inflector_backport.rb
ip_addr.rb
message_pack_extensions.rb DEV: Serialize cookies using MessagePack (#35082) 2025-10-03 11:40:49 +02:00
net_http.rb
net_http_header.rb DEV: Enable some minor rubocop rules (#40094) 2026-05-19 15:29:38 +02:00
pitchfork_sock_stream.rb DEV: Suppress Pitchfork's "Unexpected message in sig_queue" (#39985) 2026-05-13 18:37:09 +02:00
propshaft_patches.rb DEV: Replace JS build system with Rolldown (#35963) 2026-05-29 11:11:55 +01:00
rails_multisite.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
request_server_session.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
rspec_mocks_from_described_class.rb DEV: Monkey patch a from_described_class helper in RSpec::Mocks (#34021) 2025-08-05 12:03:42 +10:00
safe_buffer.rb
safe_migrations.rb
schema_migration_details.rb
translate_accelerator.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
web_push_request.rb