Athou
01ac8d6ebd
block NAT64 local-use prefix in SSRF protection
2026-11-02 13:09:31 +01:00
Athou
0c280c4dc4
invalidate existing sessions on password change
2026-11-02 12:17:45 +01:00
Athou
90d0846bad
apply timeout to all queries
2026-10-31 08:46:39 +01:00
Athou
edb4d5e178
speed up tree building by looking up unread counts in batches
2026-10-30 23:15:22 +01:00
Athou
f979f5426f
reformat using google-java-format 2.0
2026-10-30 19:39:53 +01:00
Athou
2ee2a5dfbe
standardCelRuntimeBuilder is deprecated
2026-10-27 07:23:50 +01:00
Athou
fd52caa3fd
use responseTimeout as the global timeout for the request
2026-10-20 08:47:59 +02:00
Athou
9788712808
add a global failsafe timeout to the feed fetching client
2026-10-20 08:28:15 +02:00
Athou
ab6b3b225d
Revert "add support for zstd and brotli compression" because they use native libraries that need to be extracted in a temp folder which we want to avoid
2026-10-15 08:09:18 +02:00
Athou
b865b3ff84
add support for brotli compression
2026-10-14 07:37:31 +02:00
Athou
69c1e8a5b8
add support for zstd compression
2026-10-14 07:35:49 +02:00
Athou
6e7a8c1ef6
harden iframe protocols just in case
2026-10-13 13:24:42 +02:00
Athou
44147cc062
add more default headers ( #2315 )
2026-10-13 13:06:52 +02:00
Athou
0a8c0e0c7f
don't stream the response at all if it exceeds the max size
2026-10-13 11:51:47 +02:00
Athou
f72bd4cc5c
cancel requests if interrupted
2026-10-13 11:51:47 +02:00
Athou
26cce1faac
we only need the response headers
2026-10-13 11:51:47 +02:00
Athou
3f6158fc47
add support for HTTP/2 ( #2317 )
2026-10-13 08:40:28 +02:00
Athou
43588df2b4
prevent users from starring/tagging entries that are not theirs
2026-08-22 08:14:21 +02:00
Athou
76a92ea44c
more SSRF protection regarding IPv6
2026-08-11 07:46:02 +02:00
Athou
ae3ad3745c
move global System.setProperty calls in CommaFeedApplication
2026-08-03 09:15:23 +02:00
Athou
bc6e767953
prevent XXS in third party apps
...
CommaFeed React client already strips malicious "javascript:" urls but we might as well not store those in the database
2026-08-03 08:47:01 +02:00
Athou
5d64e2f21e
correctly handle root favicons for non-default ports
2026-08-02 07:26:44 +02:00
Athou
911a5ca099
reorder imports using google java format
2026-07-29 20:36:03 +02:00
Athou
1bd9b71215
use google java formatter to avoid downloading eclipse during build
2026-07-05 11:14:17 +02:00
Athou
ca8438623d
prevent access to ULA and CGNAT addresses
2026-07-05 08:48:02 +02:00
Athou
a5f84a3f6d
search now also works for starred entries ( #2217 )
2026-07-04 17:57:08 +02:00
Athou
bdf2a6a915
the Pocket service has been discontinued
2026-07-03 22:40:38 +02:00
Athou
00d7be735a
static random fields should not be used with graalvm as they are seeded at compile time and thus not random anymore
2026-06-13 12:03:50 +02:00
Athou
1388fba8e4
apply xml cleaning to opml files
2026-06-13 11:32:57 +02:00
Athou
c43644861f
use a secure algorithm to generate image urls so that only server-side generated urls can be used
2026-06-13 11:21:16 +02:00
Athou
1faba92ecc
remove unused relationships
2026-05-27 07:28:19 +02:00
Athou
03eb09c68c
limit the number of favicon retries
2026-05-23 11:17:59 +02:00
Athou
5755ff762b
Trie is thread-safe, no need to recreate one every time
2026-05-22 20:29:48 +02:00
Athou
4a8be29616
add support for declared icons in feeds ( #2048 )
2026-05-10 21:05:33 +02:00
Athou
f207bfaddd
format empty records and anonymous types as a single line
2026-05-08 17:56:26 +02:00
Athou
9452c3e74c
remove warning
2026-04-27 18:01:02 +02:00
Athou
f826f1d543
create comparator only once
2026-04-27 18:01:02 +02:00
Athou
fd13c80e5a
allow reuse of TLS connections
2026-04-27 17:52:40 +02:00
Athou
75871348d5
compile pattern once
2026-04-27 17:46:50 +02:00
Athou
6d2fb5acc2
refactor
2026-04-10 15:17:27 +02:00
Ingo Kegel
1d23907652
Use batched IN clause for GUID existence check during feed refresh
...
Instead of fetching all existing GUID hashes for a feed from the database only check the GUIDs present in the current feed XML using a SQL IN clause. GUIDs are partitioned into batches of 1000.
Also adds an integration test verifying that refreshing an up-to-date feed does not create duplicate entries.
2026-04-10 10:13:37 +02:00
Ingo Kegel
76dbbdfbf9
batch guid existence check on feed refresh
...
Instead of querying the database once per entry to check if it already
exists, fetch all existing guids for a feed in a single query upfront
and filter new entries in memory before the per-entry loop.
The per-entry findExisting call inside addEntry is kept as a safety net
for concurrent inserts, but is now only reached for new entries.
Profiling in real usage showed a ~50% reduction in guidHash queries,
with the check falling from the most expensive query to sixth in the ranking.
2026-03-18 18:56:40 +01:00
Athou
eaa5bc896e
stop the application between tests to make sure that there are no active transactions when we truncate the tables
2026-03-04 13:58:06 +01:00
Athou
78c017ddaf
wait for tasks to complete when shutting down
2026-03-04 12:49:06 +01:00
Athou
33a0568895
delay task so that it doesn't run at the same time at OrphanedContentsCleanupTask
2026-02-20 15:55:09 +01:00
Athou
721d728906
prevent SSRF by blocking redirects from public websites to local addresses
2026-02-20 15:07:11 +01:00
Athou
3fd5cfdecd
add a setting to mark entries of a feed as read after a number of days ( #2041 )
2026-02-20 13:24:40 +01:00
Athou
6fe326f052
cleanup
2026-02-19 23:21:09 +01:00
Athou
de7e4e9c69
add a button for testing push notification settings
2026-02-19 22:50:34 +01:00
Athou
ba3214bf10
remove the possibility to receive notifications when subscribing because that sends a lot of notifications, one for each entry in the feed
2026-02-19 16:08:54 +01:00
