From 507dfd4841ac9ef6e74b29db74cef5fada7446bf Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Tue, 25 Aug 2026 21:13:56 +0200
Subject: [PATCH 1/9] devel: Use the formatting options of format_html

The string interpolation happens before `format_html` so theoretically
this allows XSS.
---
 devel/reports.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/devel/reports.py b/devel/reports.py
index ca8e9369..26166f14 100644
--- a/devel/reports.py
+++ b/devel/reports.py
@@ -21,8 +21,7 @@ def __init__(self, href, title, desc):
         self.desc = desc
 
     def __str__(self):
-        link = '<a href="%s" title="%s">%s</a>'
-        return format_html(link % (self.href, self.title, self.desc))
+        return format_html('<a href="{}" title="{}">{}</a>', self.href, self.title, self.desc)
 
 
 def linkify_non_reproducible_packages(statuses):

From d5f517b87891aba2738f1e9603a20b7e47ba7f24 Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Tue, 25 Aug 2026 21:30:34 +0200
Subject: [PATCH 2/9] sitestatic: Prevent XSS from package data

This is highly theoretical and would require the repository database to
compromised but this it is safer to construct HTML elements this way.
---
 sitestatic/homepage.js | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/sitestatic/homepage.js b/sitestatic/homepage.js
index 35dfb0ea..8a6bb7b9 100644
--- a/sitestatic/homepage.js
+++ b/sitestatic/homepage.js
@@ -53,8 +53,21 @@
 
     for (let i = 0; i < pkgs.length; i++) {
       const item = document.createElement("li");
-      const text = pkgs[i].replace(letter, `<b>${letter}</b>`);
-      item.innerHTML = `<a href="#">${text}</a>`;
+      const anchor = document.createElement("a");
+      anchor.href = "#";
+
+      const matchIndex = pkgs[i].indexOf(letter);
+      if (matchIndex !== -1) {
+        anchor.appendChild(document.createTextNode(pkgs[i].slice(0, matchIndex)));
+        const bold = document.createElement("b");
+        bold.textContent = pkgs[i].slice(matchIndex, matchIndex + letter.length);
+        anchor.appendChild(bold);
+        anchor.appendChild(document.createTextNode(pkgs[i].slice(matchIndex + letter.length)));
+      } else {
+        anchor.textContent = pkgs[i];
+      }
+
+      item.appendChild(anchor);
       item.setAttribute('data-value', pkgs[i]);
       fragment.appendChild(item);
     }

From 2fcf019a1a98608bbb99f5e75e18b2b8594eba29 Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Tue, 25 Aug 2026 21:36:02 +0200
Subject: [PATCH 3/9] sitestatic: Use modern ES6 for loop constructs

---
 sitestatic/homepage.js | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/sitestatic/homepage.js b/sitestatic/homepage.js
index 8a6bb7b9..d6e17828 100644
--- a/sitestatic/homepage.js
+++ b/sitestatic/homepage.js
@@ -51,24 +51,24 @@
     ul.style.display = "block";
     const fragment = document.createDocumentFragment();
 
-    for (let i = 0; i < pkgs.length; i++) {
+    for (const pkgname of pkgs) {
       const item = document.createElement("li");
       const anchor = document.createElement("a");
       anchor.href = "#";
 
-      const matchIndex = pkgs[i].indexOf(letter);
+      const matchIndex = pkgname.indexOf(letter);
       if (matchIndex !== -1) {
-        anchor.appendChild(document.createTextNode(pkgs[i].slice(0, matchIndex)));
+        anchor.appendChild(document.createTextNode(pkgname.slice(0, matchIndex)));
         const bold = document.createElement("b");
-        bold.textContent = pkgs[i].slice(matchIndex, matchIndex + letter.length);
+        bold.textContent = pkgname.slice(matchIndex, matchIndex + letter.length);
         anchor.appendChild(bold);
-        anchor.appendChild(document.createTextNode(pkgs[i].slice(matchIndex + letter.length)));
+        anchor.appendChild(document.createTextNode(pkgname.slice(matchIndex + letter.length)));
       } else {
-        anchor.textContent = pkgs[i];
+        anchor.textContent = pkgname;
       }
 
       item.appendChild(anchor);
-      item.setAttribute('data-value', pkgs[i]);
+      item.setAttribute('data-value', pkgname);
       fragment.appendChild(item);
     }
 

From 764aa3e8044eba0d87b7e5304eabaecaa3b73a7b Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Tue, 25 Aug 2026 21:43:19 +0200
Subject: [PATCH 4/9] main: Use format_hmtl named placeholder for formatting

This removes the need for `mark_safe`.
---
 main/templatetags/cdn.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/main/templatetags/cdn.py b/main/templatetags/cdn.py
index c87d78b4..60cae12d 100644
--- a/main/templatetags/cdn.py
+++ b/main/templatetags/cdn.py
@@ -1,7 +1,6 @@
 from django import template
 from django.contrib.staticfiles.storage import staticfiles_storage
 from django.utils.html import format_html
-from django.utils.safestring import mark_safe
 
 register = template.Library()
 
@@ -11,7 +10,7 @@ def jquery() -> str:
     version = '3.6.0'
     filename = f'jquery-{version}.min.js'
     link = staticfiles_storage.url(filename)
-    return mark_safe(f'<script type="text/javascript" src="{link}"></script>')
+    return format_html('<script type="text/javascript" src="{link}"></script>', link=link)
 
 
 @register.simple_tag

From 9f1aebcc3f53425de00a6511d604cbb9e069ac0b Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Tue, 25 Aug 2026 21:51:09 +0200
Subject: [PATCH 5/9] news: Require authentication for news preview

Posting new is an authenticated operation and so is requesting a
preview.
---
 news/views.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/news/views.py b/news/views.py
index a8009427..b961afcc 100644
--- a/news/views.py
+++ b/news/views.py
@@ -1,5 +1,6 @@
 from django import forms
 from django.conf import settings
+from django.contrib.auth.decorators import login_required
 from django.core.mail import EmailMessage
 from django.http import HttpResponse
 from django.shortcuts import get_object_or_404, redirect
@@ -82,6 +83,7 @@ def view_redirect(request, object_id):
     return redirect(newsitem, permanent=True)
 
 
+@login_required
 @require_POST
 def preview(request):
     data = request.POST.get('data', '')

From 3a88783a7bfdb73334bdb552bd22771f4ab005e7 Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Wed, 26 Aug 2026 20:15:33 +0200
Subject: [PATCH 6/9] devel: Use format_html named placeholder for formatting

---
 devel/reports.py            |  3 ++-
 devel/tests/test_reports.py | 10 ++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/devel/reports.py b/devel/reports.py
index 26166f14..8d67eb33 100644
--- a/devel/reports.py
+++ b/devel/reports.py
@@ -21,7 +21,8 @@ def __init__(self, href, title, desc):
         self.desc = desc
 
     def __str__(self):
-        return format_html('<a href="{}" title="{}">{}</a>', self.href, self.title, self.desc)
+        return format_html('<a href="{href}" title="{title}">{desc}</a>',
+                           href=self.href, title=self.title, desc=self.desc)
 
 
 def linkify_non_reproducible_packages(statuses):
diff --git a/devel/tests/test_reports.py b/devel/tests/test_reports.py
index 96b85a74..62729deb 100644
--- a/devel/tests/test_reports.py
+++ b/devel/tests/test_reports.py
@@ -1,6 +1,7 @@
 from django.contrib.auth.models import User
 from django.test import TransactionTestCase
 
+from devel.reports import Linkify
 from packages.models import PackageRelation
 
 
@@ -98,3 +99,12 @@ def test_report_pkgbases_filtered_by_maintainer(self):
             f'/devel/reports/old/{self.user.username}/pkgbases/')
         self.assertEqual(response.status_code, 200)
         self.assertEqual(response.content.decode().strip(), 'linux')
+
+
+def test_linkify_escapes_html():
+    link = Linkify(href='"><script>alert(1)</script>', title='<img onerror=alert(1)>', desc='<b>xss</b>')
+    result = str(link)
+    assert '<script>' not in result
+    assert '<img' not in result
+    assert '<b>' not in result
+    assert '&lt;script&gt;' in result

From 4c72b8287fd4b63546ae0398d507c270e3180f45 Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Wed, 26 Aug 2026 20:28:40 +0200
Subject: [PATCH 7/9] devel: Prefer filter() over .extra()

We don't have to manually ensure it hits the index anymore. This was
introduced originally in 2012, but since then the query planner has
improved.
---
 devel/views.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/devel/views.py b/devel/views.py
index 97c78568..5d0caf99 100644
--- a/devel/views.py
+++ b/devel/views.py
@@ -143,9 +143,8 @@ def clock(request):
     latest_signoff = dict(Signoff.objects.filter(
         user__is_active=True).values_list('user').order_by().annotate(
             last_signoff=Max('created')))
-    # The extra() bit ensures we can use our 'user_id IS NOT NULL' index
     latest_flagreq = dict(FlagRequest.objects.filter(
-        user__is_active=True).extra(where=['user_id IS NOT NULL']).values_list(
+        user__is_active=True, user_id__isnull=False).values_list(
             'user_id').order_by().annotate(last_flagrequest=Max('created')))
     latest_log = dict(LogEntry.objects.filter(
         user__is_active=True).values_list('user').order_by().annotate(

From 067f0ca3a3e5e412392162113aa913ab39235b1d Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Wed, 26 Aug 2026 20:48:32 +0200
Subject: [PATCH 8/9] devel: Use a fixed time comparison method for tokens

The previous comparison was vulnerable to timing side-channel attacks.
---
 devel/views.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/devel/views.py b/devel/views.py
index 5d0caf99..fd523173 100644
--- a/devel/views.py
+++ b/devel/views.py
@@ -1,4 +1,5 @@
 import base64
+import hmac
 import operator
 import time
 from datetime import timedelta
@@ -235,7 +236,7 @@ def tier0_mirror_auth(request):
     if not user:
         return unauthorized
 
-    if user and token == user.userprofile.repos_auth_token:
+    if user and hmac.compare_digest(token, user.userprofile.repos_auth_token):
         return HttpResponse('Authorized')
     else:
         return unauthorized

From 9b8c32b76829038404dcc1132e44438038811c23 Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Sat, 29 Aug 2026 15:22:55 +0200
Subject: [PATCH 9/9] pyproject: Update to latest Django

---
 pyproject.toml | 2 +-
 uv.lock        | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 1c0e4217..90d880a6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = ">=3.13"
 dependencies = [
     "bencode-py==4.1.0",
     "bleach==6.4.0",
-    "django==5.2.16",
+    "django==5.2.17",
     "django-countries==8.2.0",
     "django-csp==4.0",
     "django-prometheus==2.5.0",
diff --git a/uv.lock b/uv.lock
index 810eaf1e..a93fcebf 100644
--- a/uv.lock
+++ b/uv.lock
@@ -80,7 +80,7 @@ smtp = [
 requires-dist = [
     { name = "bencode-py", specifier = "==4.1.0" },
     { name = "bleach", specifier = "==6.4.0" },
-    { name = "django", specifier = "==5.2.16" },
+    { name = "django", specifier = "==5.2.17" },
     { name = "django-countries", specifier = "==8.2.0" },
     { name = "django-csp", specifier = "==4.0" },
     { name = "django-ninja", specifier = "==1.6.2" },
@@ -351,16 +351,16 @@ wheels = [
 
 [[package]]
 name = "django"
-version = "5.2.16"
+version = "5.2.17"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "asgiref" },
     { name = "sqlparse" },
     { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a9/26/889449d521ae508b26de715954faecd8bcf3f740affb81b2d146a83b42a5/django-5.2.16.tar.gz", hash = "sha256:59ea02020c3136fce14bef0bbece21a10a4febef5eed1c51c22ae468efa22200", size = 10890894, upload-time = "2026-07-07T13:52:17.005Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d5/d8/43e9d000519adceb189620b6869ff88031e046df91c2e9da72f8f6918399/django-5.2.17.tar.gz", hash = "sha256:9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f", size = 10889740, upload-time = "2026-08-04T15:04:03.173Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4e/13/1e5e3e4c15dcecb04281b3cb2a46a4670e1cef131068e202f6040df19224/django-5.2.16-py3-none-any.whl", hash = "sha256:04f354bf9d807a86ad1a8392fe3808d362358a8eafc322848e0e43e59b24371d", size = 8311943, upload-time = "2026-07-07T13:52:11.223Z" },
+    { url = "https://files.pythonhosted.org/packages/df/f8/ce120525ca78f12b07daf65786679c5d0b54a75285a8958d3ae55e39da35/django-5.2.17-py3-none-any.whl", hash = "sha256:f04fb3b36ee119e1af4fa1d397d5fd6cf12700f49321e84d4f4c642c5b1973db", size = 8315563, upload-time = "2026-08-04T15:03:59.1Z" },
 ]
 
 [[package]]