nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce an ImageMagick policy.xml for all pods.

Browse source 
This fix was heavily inspired by Mastodon's fix for GHSA-9928-3cp5-93fm.
So, thank you Cure53 for finding this issue, thank you Mozilla for
paying Cure53 to look into it, and thanks for Mastodon for fixing it.
This commit is contained in:
Dennis Schubert 2023-07-10 00:16:49 +02:00
parent 52f206fa8a
commit 42b835f0c0
No known key found for this signature in database
GPG key ID: 5A0304BEA7966D7E
5 changed files with 69 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Changelog.md
View file

@ -1,3 +1,7 @@
# 0.7.18.2
To avoid potential security issues, diaspora\* now makes sure that ImageMagick image processing always runs with a restricted `policy.xml`, regardless of the global system settings.
# 0.7.18.1
## Bug fixes

24
config/imagemagick/policy.xml Normal file
View file

@ -0,0 +1,24 @@
<policymap>
<policy domain="resource" name="time" value="30" />
<policy domain="resource" name="disk" value="256MiB"/>
<policy domain="resource" name="map" value="256MiB"/>
<policy domain="resource" name="memory" value="256MiB"/>
<policy domain="resource" name="height" value="56K"/>
<policy domain="resource" name="width" value="56K"/>
<policy domain="filter" rights="none" pattern="*" />
<policy domain="path" rights="none" pattern="@*" />
<policy domain="coder" rights="none" pattern="*" />
<policy domain="delegate" rights="none" pattern="*" />
<policy domain="module" rights="none" pattern="*" />
<!-- Image formats currently supported by diaspora*. -->
<policy domain="coder" rights="read | write" pattern="{GIF,JPEG,JPG,PNG,WEBP}" />
<policy domain="module" rights="read | write" pattern="{GIF,JPEG,JPG,PNG,WEBP}" />
<!-- Required for our captchas -->
<policy domain="coder" rights="read | write" pattern="LABEL" />
<policy domain="module" rights="read | write" pattern="LABEL" />
</policymap>

12
config/initializers/imagemagick.rb Normal file
View file

@ -0,0 +1,12 @@
# frozen_string_literal: true
# This is based on Mastodon doing the same, see
# https://github.com/mastodon/mastodon/blob/610cf6c3713e414995ea1a57110db400ccb88dd2/config/initializers/paperclip.rb#L157-L162
# At the time of writing, Mastodon is also licensed under the AGPL, see https://github.com/mastodon/mastodon/blob/610cf6c3713e414995ea1a57110db400ccb88dd2/LICENSE
# so the following snippet is Copyright (C) 2016-2022 Eugen Rochko & other Mastodon contributors.
ENV["MAGICK_CONFIGURE_PATH"] = begin
imagemagick_config_paths = ENV.fetch("MAGICK_CONFIGURE_PATH", "").split(File::PATH_SEPARATOR)
imagemagick_config_paths << Rails.root.join("config/imagemagick").expand_path.to_s
imagemagick_config_paths.join(File::PATH_SEPARATOR)
end
# end of Mastodon snippet

12
spec/fixtures/evil-image.ps.png vendored Normal file
View file

@ -0,0 +1,12 @@
%!
%% ohno
/Times-Roman findfont
12 scalefont
setfont
newpath
100 200 moveto
(ohno) show
showpage

17
spec/models/photo_spec.rb
View file

@ -264,4 +264,21 @@ describe Photo, :type => :model do
end
end
end
context "with a maliciously crafted image" do
let(:base_path) { File.dirname(__FILE__) }
let(:public_path) { File.join(base_path, "../../public/") }
let(:evil_image) { File.open(File.join(base_path, "..", "fixtures", "evil-image.ps.png")) }
it "fails to process a PostScript file camouflaged as a PNG" do
photo = bob.build_post(:photo, user_file: evil_image, to: @aspect.id)
expect {
with_carrierwave_processing do
photo.unprocessed_image.store! evil_image
photo.save
end
}.to raise_error(CarrierWave::ProcessingError)
end
end
end