Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-06 13:08:40 +08:00
Code Packages Activity Actions
discourse/app/services
History
Exact
Nat aea3519079 SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.5] 
Backport of #732 to release/2026.5.

---

Any AWS account holder can subscribe their own SNS topic to a Discourse instance's /webhooks/aws and publish bounce notifications that AWS will sign legitimately. The forged bounces are processed against arbitrary user emails, bumping bounce_score and eventually triggering email revocation..

This fix adds a new `aws_sns_topic_arn_allowlist` site setting. Also hardens Jobs::ProcessSnsNotification against three issues:
- Binds bounces to (message_id, to_address) via find_by, so a legitimately-subscribed SNS publisher can no longer bounce arbitrary recipients we didn't send to.
- Skips duplicate notifications (next if email_log.bounced?) — AWS SNS delivers at-least-once.
- Uses update! instead of update_columns so EmailLog's existing before_save normalizes the bounce status code.

Also add a dashboard problem flags self-hosted admins whose SMTP looks like SES but who haven't set the allowlist yet.

https://github.com/discourse/discourse/security/advisories/GHSA-8f9m-v436-wr3x
2026-06-30 16:17:06 +02:00
..
admin/search FIX: Enforce can_see_ip checks across admin IP features (#40019) 2026-05-19 11:37:20 +08:00
admin_notices FEATURE: Add problem checks page to admin panel and allow ignoring problem checks (#39103) 2026-04-23 08:28:33 +08:00
categories Revert "FIX: Moderators can enable plugins when enable_category_type_setup SiteSetting is enabled" (#40279) 2026-05-25 14:48:54 -05:00
category DEV: Replace Ruby numbered parameters by it where applicable (#37810) 2026-02-13 13:59:07 +01:00
discourse_id DEV: Allow new instances to be set up directly with Discourse ID (#36731) 2025-12-23 12:13:36 -05:00
flags FEATURE: allow edit custom flags (#32344) 2025-04-17 12:31:52 +08:00
groups DEV: Replace Ruby numbered parameters by it where applicable (#37810) 2026-02-13 13:59:07 +01:00
nested_topic REVERT: "FEATURE: Topic timeline for nested replies view (#40125)" (#40202) 2026-05-20 13:20:46 -05:00
notification/action FEATURE: Notify admins of upcoming changes and log events (#37003) 2026-01-21 12:45:54 +10:00
notifications FEATURE: Consolidate link notifications (#26567) 2024-04-09 11:53:37 -06:00
problem_check SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via webhooks [backport 2026.5] 2026-06-30 16:17:06 +02:00
site_setting DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
spam_rule FIX: Moderator notifications when new post auto-silences a user (#35403) 2025-10-15 16:07:56 +08:00
tags FIX: Make tag search consistently honour category access (#39399) 2026-05-22 18:48:15 +02:00
themes DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
upcoming_changes FEATURE: Change upcoming change available notification cadence (#40157) 2026-05-25 09:38:33 +10:00
user FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
video_conversion DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
admin_dashboard_engagement.rb FEATURE: Activity by category section of the new dashboard's engagement section (#40227) 2026-05-22 13:10:38 +08:00
admin_dashboard_highlights.rb FEATURE: Admin dashboard highlights to real data (#39895) 2026-05-12 13:15:52 +08:00
admin_dashboard_section_configuration.rb FEATURE: Allow admins to configure sections in the experimental admin dashboard (#39964) 2026-05-13 18:03:39 +08:00
admin_dashboard_site_traffic.rb FEATURE: Add top countries and top referrers cards to the admin dashboard (#40215) 2026-05-22 12:59:16 +08:00
anonymous_shadow_creator.rb FEATURE: Anonymous shadow sessions can outlive suspension of the master account (#40156) 2026-05-20 12:07:56 +08:00
badge_granter.rb FEATURE: award badges based on topic votes received (#39493) 2026-04-28 10:53:06 +10:00
base_bookmarkable.rb SECURITY: Ensure guardian check when creating QueryGroupBookmark 2026-02-26 12:22:54 +00:00
category_hashtag_data_source.rb FIX: Use unaccent() for category name/slug search (#37622) 2026-02-12 08:43:23 +01:00
color_scheme_revisor.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
destroy_task.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
email_settings_exception_handler.rb DEV: Remove IMAP support in Discourse (#37002) 2026-01-12 10:07:26 +10:00
email_settings_validator.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
email_style_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
external_upload_manager.rb SECURITY: Regular users can route multipart uploads into the admin backup store [backport 2026.5] 2026-06-30 16:17:06 +02:00
group_action_logger.rb PERF: Add Users to Group Improvements Pt. 2 (#38901) 2026-04-06 09:31:50 -05:00
group_mentions_updater.rb FIX: Sync category description when post content changes outside PostRevisor (#39184) 2026-05-11 16:13:23 +02:00
group_message.rb DEV: Don't allow context-free system post destruction (#32523) 2025-05-05 09:58:29 +08:00
handle_chunk_upload.rb DEV: Fix assigned but unused variable Prism warnings (#39436) 2026-04-22 12:42:14 +02:00
hashtag_autocomplete_service.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
heat_settings_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
hub_push_notification_pusher.rb DEV: Centralize push notification delivery into a single job (#39207) 2026-04-14 11:55:45 -03:00
inline_uploads.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
locale_normalizer.rb FIX: Show localization for regionless locale if they exist (#33702) 2025-07-21 15:45:14 +08:00
notification_emailer.rb FIX: Send notification emails for staff-coloured posts (#37712) 2026-02-11 13:26:27 +01:00
post_action_notifier.rb DEV: route bulk tag actions through PostRevisor (#37848) 2026-02-24 14:39:01 +01:00
post_alerter.rb DEV: Enable some minor rubocop rules (#40094) 2026-05-19 15:29:38 +02:00
post_bookmarkable.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
post_owner_changer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
push_notification_pusher.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
random_topic_selector.rb DEV: Remove Discourse.redis.delete_prefixed (#22103) 2023-06-16 12:44:35 +10:00
registered_bookmarkable.rb FIX: Bookmarkable query placholders (#35935) 2025-11-10 12:36:53 +10:00
search_indexer.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
sidebar_section_links_updater.rb DEV: Limit the number of category sidebar links a user can have (#26756) 2024-04-25 13:21:39 -05:00
sidebar_site_settings_backfiller.rb DEV: Drop distributed mutex fromSidebarSiteSettingsBackfiller#backfill! (#25674) 2024-02-15 06:21:03 +08:00
site_setting_update_existing_users.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
site_settings_task.rb FEATURE: mandatory fields for group site setting (#26612) 2024-04-18 08:53:52 +10:00
staff_action_logger.rb FEATURE: Create staff action log when recovering posts (#40238) 2026-05-22 10:33:02 +02:00
tag_hashtag_data_source.rb FIX: Tag search 500 when content_localization is enabled (#37769) 2026-02-12 23:58:03 +08:00
tag_settings_updater.rb FIX: Tag settings can reassign hidden synonym tags by ID (#39778) 2026-05-07 11:01:51 +10:00
theme_settings_migrations_runner.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
themes_install_task.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_bookmarkable.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
topic_status_updater.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
topic_timestamp_changer.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
tracked_topics_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
trust_level_granter.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_action_manager.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
user_activator.rb FEATURE: Prompt anonymous users to sign up after engagement clicks (#40256) 2026-05-26 09:30:38 +02:00
user_anonymizer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
user_authenticator.rb DEV: Move more data into the server session (#35145) 2025-10-03 10:20:32 +02:00
user_destroyer.rb FEATURE: Link staff action log entries to originating reviewable (#39519) 2026-04-30 09:15:45 +08:00
user_merger.rb FIX: blocks post action merge for duplicated flags (#36265) 2025-11-26 16:17:57 -03:00
user_notification_renderer.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_notification_schedule_processor.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_password_expirer.rb DEV: Migrate user passwords data to UserPassword table (#28746) 2024-10-10 09:23:06 +08:00
user_silencer.rb FIX: Prevent moderators from being auto-silenced (#39709) 2026-05-05 14:54:46 +08:00
user_stat_count_updater.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
user_suspender.rb FEATURE: Anonymous shadow sessions can outlive suspension of the master account (#40156) 2026-05-20 12:07:56 +08:00
user_updater.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
username_changer.rb DEV: Enable Style/RedundantSelf rubocop rule (#40098) 2026-05-19 19:27:45 +02:00
username_checker_service.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
web_hook_emitter.rb DEV: Move webhook event header modifier for redelivery-recalucation (#27177) 2024-05-24 10:37:10 -05:00
wildcard_domain_checker.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
wildcard_url_checker.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
word_watcher.rb FIX: Watched word with invalid regex crashes markdown cook (#40107) 2026-05-18 16:04:20 +08:00