LoginSign Up
← Back to all sparks
C

CommaFeed

COLLAB
Velocity5.0

Self-hosted Google Reader inspired RSS feed reader

www.commafeed.com ↗

After a summer of security patches, CommaFeed 7.4 moves feed fetching to HTTP/2.

rss-readerself-hostedsecurity-hardeninghttp2open-source
◆Current state
CommaFeed's 7.x line spent July and August on security fixes, one per patch release: an image-proxy SSRF, javascript: URLs filtered at parse time, local address blocking on by default, Host header injection in password recovery, and a cross-user disclosure via starring and tagging. Version 7.4.0 on October 19 turned back to fetching, with HTTP/2, more default headers so fewer servers reject it, and tighter iframe sandboxing; 7.4.1 three days later fixed entries being marked read on scroll-back and added an HTTP/2 timeout.
◆Where it's heading
With the security backlog cleared, releases are shifting to feed compatibility and reading behavior. The quick 7.4.1 follow-up suggests the HTTP/2 client is still settling.
◆Prediction
Further 7.4.x patches for the HTTP/2 client are the likeliest next entries.

◆Recent moves

  1. 18d ago

    CommaFeed 7.4.1

    Fixes entries being marked read when scrolling back, adds a failsafe timeout to the HTTP/2 client and an OCI source label. Small fixes.

    View source ↗
  2. 21d ago

    CommaFeed 7.4.0

    CommaFeed 7.4.0 fetches feeds over HTTP/2, sends more default headers so fewer servers reject it, and restricts iframe sources in feed content to http and https.

    View source ↗
  3. 2mo ago

    Cross-user entry disclosure via starring and tagging closed

    Starring or tagging an entry belonging to another user made it readable to the attacker — an ownership check missing on the write path, leaking through the read path. It is the first fix in this run that is about users abusing each other rather than about hostile external input, which moves the security pass from the perimeter to the authorization model.

    View source ↗
  4. 2mo ago

    Host header injection closed on the password recovery endpoint

    The password recovery email had been building its base URL from the incoming request. A new configuration setting makes that URL explicit, removing an attacker-controlled header from the path of an outbound credential email.

    View source ↗
  5. 3mo ago

    Google Reader API support and secure-by-default local address blocking

    Adds Google Reader API compatibility while flipping local address blocking to on by default, closing the server-side request forgery path a feed fetcher inherits. A feature and a hardening default shipped together.

    View source ↗
  6. 3mo ago

    javascript: URLs now filtered at parse time, not just in the renderer

    Moves javascript: URL filtering earlier, so hostile feed content is stripped as it is parsed rather than relied upon to be neutralised at render. Defence moved closer to the untrusted boundary.

    View source ↗