5.8.0

.bundler-audit.yml

@@ -0,0 +1,6 @@
+---
+ignore:
+  # Sinatra ReDoS (ETag header) - sinatra 4.2.0で修正だが、
+  # rack 3.2 + Sinatra 4.2.0でトークン汚染インシデント発生のため
+  # sinatra 4.1.1に固定中。docs/postmortem-2025-10-rack32.md 参照
+  - GHSA-mr3q-g2mv-mr4q

Gemfile

@@ -20,6 +20,7 @@ gem 'sentry-sidekiq'
 gem 'sidekiq', '~>8.1'
 gem 'sidekiq-scheduler', '~>6.0.1'
 group :development do
+  gem 'bundler-audit'
   gem 'ostruct' # gli < 2.22の未宣言依存
   gem 'rack-test'
   gem 'rails-erb-lint'

Gemfile.lock

@@ -42,7 +42,7 @@ GIT
 
 GIT
   remote: https://github.com/pooza/ginseng-fediverse.git
-  revision: d780863b197b054aa91e15dfe9acacd7c022e41b
+  revision: 3a30745ecc8661a22fdf5cb5c4cc0bc1fe756cb5
   branch: main
   specs:
     ginseng-fediverse (1.8.21)
@@ -125,6 +125,9 @@ GEM
     base64 (0.3.0)
     bigdecimal (4.0.1)
     builder (3.3.0)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
+      thor (~> 1.0)
     cgi (0.5.1)
     concurrent-ruby (1.3.6)
     connection_pool (3.0.2)
@@ -205,7 +208,7 @@ GEM
       multi_xml (>= 0.5.2)
     i18n (1.14.8)
       concurrent-ruby (~> 1.0)
-    json (2.19.0)
+    json (2.19.1)
     json-schema (6.2.0)
       addressable (~> 2.8)
       bigdecimal (>= 3.1, < 5)
@@ -346,7 +349,7 @@ GEM
       rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.0)
+    rubocop-ast (1.49.1)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     rubocop-minitest (0.39.1)
@@ -417,11 +420,12 @@ GEM
     temple (0.10.4)
     test-unit (3.7.7)
       power_assert
+    thor (1.5.0)
     tilt (2.1.0)
     time (0.4.2)
       date
     timecop (0.9.10)
-    timeout (0.6.0)
+    timeout (0.6.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
@@ -449,6 +453,7 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
+  bundler-audit
   concurrent-ruby
   dry-validation
   faye-websocket!

app/lib/mulukhiya.rb

@@ -38,11 +38,23 @@ def self.setup_sentry
       config.release = Package.version
       config.environment = Environment.type
       config.traces_sample_rate = Config.instance['/sentry/traces_sample_rate'] || 0
+      config.before_send = method(:scrub_sentry_event)
     end
   rescue => e
     warn "Sentry initialization skipped: #{e.message}"
   end
 
+  def self.scrub_sentry_event(event, _hint)
+    patterns = (Config.instance['/sentry/scrub_patterns'] || []).map {|p| Regexp.new(p)}
+    return event if patterns.empty?
+    event.exception&.values&.each do |ex| # rubocop:disable Style/HashEachMethods
+      patterns.each do |pattern|
+        ex.value = ex.value&.gsub(pattern, '[FILTERED]')
+      end
+    end
+    return event
+  end
+
   def self.setup_debug
     Ricecream.disable
     return unless Environment.development?

app/lib/mulukhiya/config.rb

@@ -31,6 +31,7 @@ def about
           controller: self['/controller'],
           status: Environment.status_class.default.merge(
             label: controller.status_label,
+            reblog_label: controller.reblog_label,
             max_length: controller.max_length,
           ),
           capabilities: sub_hash("/#{name}/capabilities"),

app/lib/mulukhiya/controller/mastodon_controller.rb

@@ -14,7 +14,7 @@ class MastodonController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -33,7 +33,7 @@ class MastodonController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -48,7 +48,35 @@ class MastodonController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
+      @renderer.message = {error: e.message}
+      @renderer.status = e.source_status
+      return @renderer.to_s
+    end
+
+    put '/api/:version/statuses/:id' do
+      verify_token_integrity!
+      purpose = request.env['HTTP_X_MULUKHIYA_PURPOSE']
+      body = case purpose
+             when nil, '', 'media_update'
+               source = sns.fetch_status_source(params[:id], {headers: @headers})
+               {status: source['text'], media_attributes: params[:media_attributes]}.compact
+             when 'tag'
+               {status: params[:status], media_attributes: params[:media_attributes]}.compact
+             else
+               raise Ginseng::ValidateError, "unknown purpose: #{purpose}"
+             end
+      raise Ginseng::ValidateError, 'media_attributes is required' if body.empty?
+      reporter.response = sns.update_status(params[:id], body, {headers: @headers})
+      @renderer.message = reporter.response.parsed_response
+      @renderer.status = reporter.response.code
+      return @renderer.to_s
+    rescue Ginseng::ValidateError => e
+      @renderer.message = {error: e.message}
+      @renderer.status = 422
+      return @renderer.to_s
+    rescue Ginseng::GatewayError => e
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -63,7 +91,7 @@ class MastodonController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -78,7 +106,7 @@ class MastodonController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -93,7 +121,7 @@ class MastodonController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s

app/lib/mulukhiya/controller/misskey_controller.rb

@@ -14,7 +14,7 @@ class MisskeyController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -32,7 +32,7 @@ class MisskeyController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -56,7 +56,7 @@ class MisskeyController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -75,7 +75,7 @@ class MisskeyController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -89,7 +89,7 @@ class MisskeyController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s
@@ -103,7 +103,7 @@ class MisskeyController < Controller
       @renderer.status = reporter.response.code
       return @renderer.to_s
     rescue Ginseng::GatewayError => e
-      e.alert
+      e.alert unless e.source_status == 401
       @renderer.message = {error: e.message}
       @renderer.status = e.source_status
       return @renderer.to_s

app/lib/mulukhiya/controller/ui_controller.rb

@@ -19,8 +19,13 @@ class UIController < Controller
     end
 
     get '/oauth/callback' do
-      raise Ginseng::AuthError, 'Missing state' unless params[:state]
-      raise Ginseng::AuthError, 'Missing code' unless params[:code]
+      unless params[:state] && params[:code]
+        @renderer = SlimRenderer.new
+        @renderer.template = 'token_error'
+        @renderer[:error] = 'Missing required OAuth parameters'
+        @renderer.status = 400
+        return @renderer.to_s
+      end
       result = sns.auth_with_pkce(params[:code], params[:state])
       raise Ginseng::AuthError, 'Token exchange failed' unless result
       parsed = result.parsed_response

app/lib/mulukhiya/controller_methods.rb

@@ -175,6 +175,10 @@ def status_label
         return config["/#{name}/status/label"]
       end
 
+      def reblog_label
+        return config["/#{name}/status/reblog_label"]
+      end
+
       def status_delete_limit
         return config["/#{name}/status/delete/limit"] rescue nil
       end

app/task/bundler_audit.rb

@@ -0,0 +1,11 @@
+module Mulukhiya
+  extend Rake::DSL
+
+  namespace :bundler_audit do
+    desc 'bundler-audit'
+    task :check do
+      Dir.chdir(Environment.dir)
+      sh 'bundler-audit check --update'
+    end
+  end
+end

app/task/lint.rb

@@ -2,5 +2,5 @@ module Mulukhiya
   extend Rake::DSL
 
   desc 'lint all'
-  task lint: ['erb:lint', 'slim:lint', 'rubocop:lint', 'yaml:lint']
+  task lint: ['erb:lint', 'slim:lint', 'rubocop:lint', 'yaml:lint', 'bundler_audit:check']
 end

config/application.yaml

@@ -323,6 +323,7 @@ mastodon:
       limit: 30
     key: id
     label: 投稿
+    reblog_label: ブースト
     parser: toot
     spoiler_text: null
   streaming:
@@ -377,6 +378,7 @@ misskey:
     default_max_length: 3000
     key: noteId
     label: ノート
+    reblog_label: リノート
     parser: note
     spoiler_text: null
   streaming:
@@ -404,7 +406,7 @@ package:
     - tkoishi@b-shock.co.jp
   license: MIT
   url: https://github.com/pooza/mulukhiya-toot-proxy
-  version: 5.7.0
+  version: 5.8.0
 parser:
   note:
     fields:
@@ -449,6 +451,10 @@ redis:
 sentry:
   dsn: null
   traces_sample_rate: 0
+  scrub_patterns:
+    - '[a-zA-Z0-9_\-]{20,}'
+    - '/home/[^\s]+'
+    - '/Users/[^\s]+'
 ruby:
   bundler:
     install: false

config/sample/mastodon/mulukhiya.nginx

@@ -8,7 +8,7 @@ map "${request_method}:${http_x_mulukhiya}" $media_put_backend {
   default    http://localhost:3000;
 }
 map "${request_method}:${http_x_mulukhiya}" $status_put_backend {
-  "~^PUT:$"  reject;
+  "~^PUT:$"  http://localhost:3008;
   default    http://localhost:3000;
 }
 
@@ -28,12 +28,6 @@ location ~ ^/api/v[0-9]+/media/[0-9]+$ {
 }
 location ~ ^/api/v[0-9]+/statuses/[0-9]+$ {
   include /path/to/mulukhiya_proxy.conf;
-  if ($http_x_mulukhiya_purpose != '') {
-    proxy_pass http://localhost:3008;
-  }
-  if ($status_put_backend = reject) {
-    return 405;
-  }
   proxy_pass $status_put_backend;
 }
 location = /api/v1/timelines/public {