Delete This Post

This action will delete this post on this instance and on all federated instances, and it cannot be undone. Are you certain you want to delete this post?

No
Yes
Block This Actor

This action will block this actor and hide all of their past and future posts. Are you certain you want to block this actor?

No
Yes
Block This Object

This action will block this object. Are you certain you want to block this object?

No
Yes
Delete OAuth Client

Are you sure you want to delete the OAuth client [Client Name]? This action cannot be undone and will revoke all access tokens for this client.

No
Yes
Revoke OAuth Token

Are you sure you want to revoke the OAuth token [Token ID]? This action cannot be undone and will immediately revoke access for this token.

No
Yes
Todd Sundsted
Todd Sundsted posted 10:38am
Release v3.3.7 of Ktistec

Release v3.3.7 of Ktistec fixes several bugs and introduces two enhancements.

Security is a focus in this release. Every gap in input sanitization or escaping is a potential vulnerability, and I've been systematically closing them. I am also carefully, and maybe conservatively, restricting things like supported URL schemes and uploaded file types.

The two enhancements improve compatibility with Mastodon-compatible clients. Mastodon's OAuth tokens don't expire, and Mastodon clients don't know how to handle tokens that do. Sliding expiration ensures that tokens in active use stay alive, while unused tokens eventually expire.

Here's the full changelog:

Added

  • Sliding token expiration for OAuth2 access tokens.
  • Mastodon-compatible API: /api/v1/accounts/update_credentials endpoint.

Fixed

  • Prevent pinning of (and auto-unpin) private objects.
  • Don't save a quote if the quoted actor cannot be dereferenced.
  • Fix rendering of federated actor profile attachment values.
  • Remove href attributes with unsafe schemes from sanitized HTML.
  • Escape interpolated values in view helpers and the actor icon streaming refresh.
  • Restrict upload extensions and serve uploads with X-Content-Type-Options: nosniff.
  • Escape publicKey and scrub Tag.href.
  • Sanitizer no longer permits single-quote attribute injection.
  • Ensure bearer-token sessions cannot reach the web UI.
  • Require client authentication on the OAuth token endpoint.

I'm working on performance improvements for the next release. A rewrite of the Slang template library looks like it will cut both build time and executable size by around 10%!

📡 Stay tuned!

#ktistec #crystallang #activitypub #fediverse