search

Novik / ruTorrent

Yet another web front-end for rTorrent
Other
2.02k stars 407 forks source link

RSS-plugin: Provide a less restricted view #2462

Open TrimmingFool opened 1 year ago

TrimmingFool commented 1 year ago

Is your feature request related to a problem?

A less restricted view was first requested in https://github.com/Novik/ruTorrent/issues/2426. However, stickz worries that users may fall victim to phishing attacks if we show <a> links as in https://github.com/Novik/ruTorrent/pull/2429. Additionally, there is also a privacy threat when trying to show <img> resources from an unknown source in the browser.

We need more security features to protect against things like malware and child exploitation, before we can allow relaxing the RSS sanitation level changes --- stickz

Describe the solution you'd like

In my opinion, providing an option to show <a> links is reasonable since the user can hover the link to see where it leads. On the other hand, <img> should not be fetched unless the request is proxied.

Suggestions by stickz:

  1. A hint box displaying the URL when the user hovers over the link in the RSS feed.
  2. A warning hint box in the settings menu that phishing links cause malware.
  3. Whitelist image hosts that are not part of the domain of the RSS feed .

Further security/privacy feature ideas by me:

  1. A trust level profile (such as public, private) for individual RSS feeds, instead of Secure and Insecure
  2. Proxy images with action.php?fetchurl=...
  3. Verify that the domain of the RSS links guid (opened with dblclick) or the torrent url matches the RSS feed domain

Additional context

Novik suggested to add noreferrer to links https://github.com/Novik/ruTorrent/issues/2426#issuecomment-1368454942

stickz commented 1 year ago

We can use GD to remove exif data from images before displaying them. However, we would need to create a new plugin and consider temporarily caching images processed. https://www.php.net/manual/en/book.image.php

Links should only be trusted (by default) if they belong to the domain of the RSS feed. We can distribute a whitelist file with preset values such as https://www.imdb.com/ so users can read movie reviews. noreferrer should be added to links for privacy.

stale[bot] commented 11 months ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.