Yurik has uploaded a new change for review.
https://gerrit.wikimedia.org/r/202917
Change subject: Security fixes per review
......................................................................
Security fixes per review
* Set defaultProtocol to https
* Added an extra check to make sure protocol is http or https
* Added: Content-Disposition: attachment; filename="whatever.png"
Bug: T93126
Change-Id: If19d4e0204f17220ff49ab06bcc573be9f97e7b5
---
M routes/v1.js
1 file changed, 5 insertions(+), 1 deletion(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/services/graphoid
refs/changes/17/202917/1
diff --git a/routes/v1.js b/routes/v1.js
index 1fdf721..cac0252 100644
--- a/routes/v1.js
+++ b/routes/v1.js
@@ -30,7 +30,7 @@
/**
* For protocol-relative URLs (they begin with //), which protocol should we
use
*/
-var defaultProtocol = 'http';
+var defaultProtocol = 'https';
/**
* Limit request to 10 seconds by default
@@ -109,6 +109,9 @@
if (url) {
var parts = urllib.parse(url);
if (!parts.protocol || !parts.hostname) {
+ url = null;
+ } else if (parts.protocol !== 'http:' && parts.protocol !==
'https:') {
+ // load.sanitizeUrl() already does this, but double check to
be safe
url = null;
}
}
@@ -305,6 +308,7 @@
} else {
var stream = result.canvas.pngStream();
state.response.status(200).type('png');
+ state.response.header('Content-Disposition', 'attachment;
filename="' + state.graphId + '.png"');
stream.on('data', function (chunk) {
state.response.write(chunk);
});
--
To view, visit https://gerrit.wikimedia.org/r/202917
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: If19d4e0204f17220ff49ab06bcc573be9f97e7b5
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/services/graphoid
Gerrit-Branch: master
Gerrit-Owner: Yurik <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
