https://webb.spiderden.org/2023/05/26/pleroma-mitigation/
@w Nice guide!
I only have one question: why reconfigure Pleroma to use the subdomain for uploads if I set up a redirect anyway? When permanent fix arrives I can just get rid of the subdomain, but if I reconfigure Pleroma, URLs in new posts would have the subdomain in them so I would have to keep it up (and its cert) forever so the links to images don't become broken.
@w No, I get it, but if redirect fixes it for old posts, why won't it do the trick for new ones? Why is it necessary for newer post to contain direct links to https://media.my.domain, not the usual https://my.domain/media, that get redirected to https://media.my.domain?
Is it assumed that older posts don't contain the malicious script, but newer ones might? Is redirect treated differently from XSS perspective?
