Dionisio
33cfb0faef
- V-02: XSS via innerHTML in profile.js — wrap err.message in escapeHtml() - V-03: IDOR upload to other users' folders — add folder ownership check - V-04: IDOR create folders in other users' trees — add parent ownership check - V-06: Content-Disposition header injection — RFC 5987 percent-encoding - V-08: WebDAV MOVE/COPY destination without ownership — add assert_owner checks - V-09: .gitignore missing cert/key patterns — add *.pem, *.key, *.p12, etc. - V-11: Username accepts XSS payloads — restrict to [a-zA-Z0-9._-] - V-12: Minimal email validation — reject forbidden chars, require domain dot - V-13: admin_reset_password doesn't invalidate sessions — revoke all sessions - V-14: Rate limiting bypassable via X-Forwarded-For — gate behind OXICLOUD_TRUST_PROXY_HEADERS - V-15: Cookie Secure flag off by default — default to true (safe-by-default) - V-16: LIKE wildcard injection in searches — add like_escape() helper across 9 sites
76 lines
1.0 KiB
Plaintext
76 lines
1.0 KiB
Plaintext
# Generated by Cargo
|
|
/target/
|
|
**/target/
|
|
|
|
# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
|
|
# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
|
|
# Cargo.lock
|
|
|
|
# These are backup files generated by rustfmt
|
|
**/*.rs.bk
|
|
|
|
# MSVC Windows builds of rustc generate these, which store debugging information
|
|
*.pdb
|
|
|
|
# Rust debug symbols
|
|
*.dSYM/
|
|
*.su
|
|
*.idb
|
|
|
|
# Build cache
|
|
.cargo/
|
|
|
|
# Visual Studio Code directory
|
|
.vscode/
|
|
|
|
# JetBrains IDEs
|
|
.idea/
|
|
|
|
# MacOS specific
|
|
.DS_Store
|
|
.AppleDouble
|
|
.LSOverride
|
|
|
|
# Linux specific
|
|
*~
|
|
.directory
|
|
.Trash-*
|
|
|
|
# Windows specific
|
|
Thumbs.db
|
|
ehthumbs.db
|
|
Desktop.ini
|
|
|
|
# Node.js (if used for frontend)
|
|
node_modules/
|
|
npm-debug.log
|
|
|
|
# Environment variables
|
|
.env
|
|
.env.local
|
|
.env.development.local
|
|
.env.test.local
|
|
.env.production.local
|
|
|
|
# Log files
|
|
*.log
|
|
logs/
|
|
|
|
# Storage data (user files, blobs — never commit)
|
|
storage/
|
|
|
|
# TLS certificates and private keys — NEVER commit
|
|
*.pem
|
|
*.key
|
|
*.p12
|
|
*.pfx
|
|
*.crt
|
|
*.csr
|
|
|
|
# Temporary files
|
|
*.tmp
|
|
*.bak
|
|
*.swp
|
|
*.swo
|
|
nohup.out
|