11 releases 11 tags

RSS feed

• v1.3.1 678937f18b

  Compare

  v1.3.1 Stable

  spalencsar released this 2026-10-18 17:25:05 +02:00 | 0 commits to main since this release

  Security and maintenance release: SSRF defense for station artwork and discovery, owner-only permissions for persisted stream credentials, plain-text metadata rendering against rich-text injection, and native desktop window decorations.

  Security

  • Artwork & Discovery SSRF Defense (NetworkUrlGuard): Block private, loopback, link-local, and special network targets during station artwork and icon discovery. Hostnames are resolved asynchronously before network requests, unsafe DNS responses are rejected, requests are pinned to validated IP addresses with HTTP/2 and proxy bypass, and redirects are re-validated.
  • Protected File Permissions: Restrict the BearWave configuration directory to owner-only (0700) and persisted JSON files (my_stations.json, favorites.json, state.json) to 0600 using atomic QSaveFile writes to safeguard sensitive stream credentials.
  • Literal Plain-Text Rendering: Force untrusted remote station metadata, ICY playback status, session track history, tags, and codec information to render as literal plain text (Text.PlainText) across QML components to eliminate rich-text HTML/SSRF injection vectors.

  Fixed

  • Native Window Decorations: Restored standard native window decorations across Linux desktops (resolves missing title bar and window controls on Linux Mint Cinnamon).
  • Test Isolation: Playback and Radio Browser unit tests now run against isolated XDG test paths instead of developer configuration, cached API data, or live network calls.

  Installation & Updates

  • Flatpak:

    flatpak update de.nerdbear.bearwave
    

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads