Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-08-30 11:18:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: vulnerability in cover and admin uploads (#8419)

Browse Source 
* fix: vulnerability in cover and admin uploads

* fix: remove old test

* fix: update tests
This commit is contained in:
Barış Soner Uşaklı
2020-06-22 12:08:35 -04:00
committed by GitHub
parent 76c577fa3c
commit 48b41debe6
8 changed files with 66 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/file.js
View File

@@ -30,6 +30,9 @@ file.saveFileToLocal = async function (filename, folder, tempPath) {
filename = filename.split('.').map(name => utils.slugify(name)).join('.');
const uploadPath = path.join(nconf.get('upload_path'), folder, filename);
if (!uploadPath.startsWith(nconf.get('upload_path'))) {
throw new Error('[[error:invalid-path]]');
}
winston.verbose('Saving file ' + filename + ' to : ' + uploadPath);
await mkdirp(path.dirname(uploadPath));

2
src/image.js
View File

@@ -101,7 +101,7 @@ image.stripEXIF = async function (path) {
const sharp = requireSharp();
await sharp(buffer, { failOnError: true }).rotate().toFile(path);
} catch (err) {
winston.error(err);
winston.error(err.stack);
}
};

29
src/user/picture.js
View File

@@ -45,9 +45,9 @@ module.exports = function (User) {
validateUpload(data, meta.config.maximumCoverImageSize, ['image/png', 'image/jpeg', 'image/bmp']);
picture.path = await getTempPath(data);
picture.path = await image.writeImageDataToTempFile(data.imageData);
const extension = file.typeToExtension(getMimeType(data));
const extension = file.typeToExtension(image.mimeFromBase64(data.imageData));
const filename = data.uid + '-profilecover' + extension;
const uploadData = await image.uploadImage(filename, 'profile', picture);
@@ -61,7 +61,7 @@ module.exports = function (User) {
url: uploadData.url,
};
} finally {
file.delete(picture.path || (data.file && data.file.path));
file.delete(picture.path);
}
};
@@ -78,12 +78,12 @@ module.exports = function (User) {
validateUpload(data, meta.config.maximumProfileImageSize, User.getAllowedImageTypes());
const extension = file.typeToExtension(getMimeType(data));
const extension = file.typeToExtension(image.mimeFromBase64(data.imageData));
if (!extension) {
throw new Error('[[error:invalid-image-extension]]');
}
picture.path = await getTempPath(data);
picture.path = await image.writeImageDataToTempFile(data.imageData);
picture.path = await convertToPNG(picture.path);
await image.resizeImage({
@@ -101,36 +101,25 @@ module.exports = function (User) {
});
return uploadedImage;
} finally {
file.delete(picture.path || (data.file && data.file.path));
file.delete(picture.path);
}
};
function validateUpload(data, maxSize, allowedTypes) {
if (!data.imageData && !data.file) {
if (!data.imageData) {
throw new Error('[[error:invalid-data]]');
}
const size = data.file ? data.file.size : image.sizeFromBase64(data.imageData);
const size = image.sizeFromBase64(data.imageData);
if (size > maxSize * 1024) {
throw new Error('[[error:file-too-big, ' + maxSize + ']]');
}
const type = getMimeType(data);
const type = image.mimeFromBase64(data.imageData);
if (!type || !allowedTypes.includes(type)) {
throw new Error('[[error:invalid-image]]');
}
}
function getMimeType(data) {
return data.file ? data.file.type : image.mimeFromBase64(data.imageData);
}
async function getTempPath(data) {
if (data.file) {
return data.file.path;
}
return await image.writeImageDataToTempFile(data.imageData);
}
async function convertToPNG(path) {
const convertToPNG = meta.config['profile:convertProfileImageToPNG'] === 1;
if (!convertToPNG) {