pleroma/changelog.d/mrf-domain-regex-escape.security
Lain Soykaf 7e157d8cc9
fix(mrf): match domain rules literally
Escape the domain so `.` only matches a dot, and use an optional
group for the `*.` prefix, which matches the same hosts without
exponential backtracking. Bad entries now match nothing instead of
raising on every check.
2026-10-31 13:17:50 +04:00

1 line
172 B
Text

MRF domain rules now match dots literally, so a rule for `good.example` no longer also matches `goodxexample`, and wildcard rules no longer backtrack on hostile host names