blacktop
c20f9af712
fix: multiple security vulnerabilities (SSRF, path traversal)
...
- Remove POST /diff/files endpoint that allowed arbitrary host file reads
(CWE-22); clients must now read files locally and POST content to
/diff/blobs instead
- Add validatePublicURL() to /info remote endpoints, rejecting URLs that
resolve to loopback, private, link-local, or multicast addresses to
prevent SSRF; also remove attacker-controlled proxy/insecure params
- Add SanitizeArchivePath() helper that verifies extracted archive entry
paths stay within the destination directory (zip-slip / tar-slip,
CWE-22); replace bare filepath.Join(dest, filepath.Clean(name)) calls
in SearchZip, OTA parser, AA payload extractor, and ota_extract
- Fix server listen address to use net.JoinHostPort to respect Host config
2026-04-11 14:37:41 -06:00
blacktop
7e531f5d11
docs: update download guide to include all new-ish commands
2025-07-13 18:37:12 -06:00
blacktop
b8c2166613
chore: rm old sqlite db
2025-06-17 15:32:43 -06:00
blacktop and GitHub
beac6c4d38
docs: entitlement database - move from sql.js-httpvfs to hosted postgres ( #770 )
2025-06-17 15:19:40 -06:00
blacktop
0a911c08db
docs: CORS!
2025-06-17 11:55:36 -06:00
blacktop
de619e7a30
Update ipsw.db
2025-06-17 10:43:23 -06:00
blacktop
9c7eb80b30
docs: update entitlements DB schema
2025-06-17 00:36:59 -06:00
blacktop
d51bd73fa7
Update ipsw.db
2025-06-16 23:18:26 -06:00
blacktop
0b74f8008e
Update ipsw.db
2025-06-16 23:01:40 -06:00
blacktop
5c704cd66c
Update ipsw.db
2025-06-16 22:08:04 -06:00
blacktop
d9ed200b0c
docs: fix docs
2025-06-16 21:33:42 -06:00
blacktop
33a6b8737c
docs: fix docs
2025-06-16 21:29:09 -06:00
blacktop
ce69e00a65
Update ipsw.db
2025-06-16 21:13:30 -06:00
blacktop
c07b43b9bc
docs: fix entitlements page
2025-06-16 21:01:18 -06:00
blacktop
e48a380571
docs: update entitlements page to use new schema
2025-06-16 19:59:02 -06:00
blacktop
ad8e389eb9
fix: broken entitlement DB
2025-06-16 18:15:42 -06:00
github-actions[bot]
9cf9e0188e
chore(ents): update to https://updates.cdn-apple.com/2025SpringFCS/fullrestores/082-45783/9A345601-C46E-4195-A367-4BCA31447055/iPhone17,1_18.5_22F76_Restore.ipsw [skip ci]
2025-06-14 19:16:27 +00:00
github-actions[bot]
771d9eb90d
chore(ents): update to https://updates.cdn-apple.com/2025SpringFCS/fullrestores/082-45783/9A345601-C46E-4195-A367-4BCA31447055/iPhone17,1_18.5_22F76_Restore.ipsw [skip ci]
2025-06-13 19:17:52 +00:00
blacktop
8175f5821a
chore: configure Git LFS to track ipsw.db
2025-06-11 16:24:11 -06:00
blacktop
49b2522459
chore(entdb): add iOS 26.0beta to EntitlementDB
2025-06-09 16:06:55 -06:00
blacktop
432375f398
chore: attempt to optimize ent db for loading over web
2025-06-09 00:04:58 -06:00
blacktop and GitHub
4872f5998f
feat: 🆕 Entitlements DB web UI in docs site ( #751 )
2025-06-08 22:30:03 -06:00
blacktop
cb138b0bc4
docs: update CLI docs
2025-03-29 22:31:06 -06:00
blacktop
2aacaf66d2
feat: add NEW /macho/info/strings route to ipswd
2024-10-14 14:54:40 -06:00
blacktop
bfb1587367
docs: fix API docs for /syms/rescan
2024-10-02 14:48:47 -06:00
blacktop
b236da9b7d
chore: change /syms/rescan from POST to PUT
2024-09-26 12:56:54 -06:00
blacktop
db74fb9cc4
docs: add API docs for /syms/rescan route
2024-09-25 16:06:29 -06:00
blacktop
fda8c8e071
fix: postgres name/path table joins
2024-09-25 15:22:37 -06:00
blacktop
5947486258
chore: also add sig_dir as an optional POST query param in addition to config setting
2024-09-19 19:23:28 -06:00
blacktop
91ccb2b225
docs: update symbolicate guide to include symbol server daemon config example
2024-09-19 19:11:19 -06:00
blacktop
455d715be5
docs: update CLI docs
2024-07-27 23:33:06 -06:00
blacktop
639ce7ea38
docs: fix API docs
2024-07-10 15:02:39 -06:00
blacktop
24ac286b16
docs: fix API return type for /aea/fcs-keys
2024-07-10 14:53:06 -06:00
blacktop
87edee4d16
docs: add API docs for /aea route
2024-07-10 14:40:51 -06:00
blacktop
ae2a4dd4ae
docs: small tweak
2024-07-09 18:45:30 -06:00
blacktop
c83dfbab77
docs: add docs explaining how the 🆕 symbol server works
2024-07-09 18:29:55 -06:00
blacktop
cc2035f729
docs: fix AEA guild imgs
2024-07-08 23:11:01 -06:00
blacktop
872052edd5
docs: update API docs for NEW pem_db field
2024-07-08 22:19:14 -06:00
blacktop
5cce056e0c
chore: add ability for the ipsw symbolicate symbol server to tell you it doesn't have the required IPSW scanned yet
2024-07-05 17:37:15 -06:00
blacktop
29b8785af8
feat: add support for using **symbol server** with ipsw symbolicate command
2024-07-05 15:03:25 -06:00
blacktop
4e1d85458e
docs: smol fix
2024-07-04 00:28:23 -06:00
blacktop
e4633fb3a2
docs: minor API doc fix
2024-07-03 17:43:39 -06:00
blacktop
5a9da7d4b0
docs: fix API docs
2024-07-03 17:16:12 -06:00
blacktop
9f56962735
feat: add ability to query symbols via ipswd API routes /api/syms/:uuid and /api/syms/:uuid/:addr
2024-07-03 17:02:08 -06:00
blacktop
8f8ef4b024
Update swagger.json
2024-07-02 20:51:07 -06:00
blacktop
1dda3daa4f
docs: update docs
2024-07-02 20:50:45 -06:00
blacktop
da74430c69
docs: fix docs
2023-09-06 18:40:40 -06:00
blacktop
0e7d10e289
docs: update docs
2023-08-29 20:43:57 -06:00
blacktop
b979602be2
docs: update docs
2023-08-26 23:09:33 -06:00
blacktop
3f00d1e324
Update swagger.json
2023-08-26 21:01:04 -06:00
blacktop
github-actions[bot]