Revision: 43660
Author: tstarling
Date: 2008-11-18 05:07:54 +0000 (Tue, 18 Nov 2008)
Log Message:
-----------
Improved the security of wfStreamFile():
* Use the file extension to determine Content-Type, don't look for magic
numbers. This makes the attack surface similar to ordinary web server
downloads, and avoids problems when MIME type is not checked on upload.
* Use the same restrictions for Content-Type when streaming as for uploading.
This closes any vulnerabilities caused by a change to a more secure
configuration, post-upload.
* Don't stream out the file after headers are unexpectedly sent (e.g. due to
display_errors). The Content-Type will typically be fixed to text/html in this
case and so we need to be careful what we send.
Modified Paths:
--------------
trunk/phase3/includes/StreamFile.php
Modified: trunk/phase3/includes/StreamFile.php
===================================================================
--- trunk/phase3/includes/StreamFile.php 2008-11-18 02:53:29 UTC (rev
43659)
+++ trunk/phase3/includes/StreamFile.php 2008-11-18 05:07:54 UTC (rev
43660)
@@ -31,6 +31,12 @@
header('Content-type: application/x-wiki');
}
+ // Don't stream it out as text/html if there was a PHP error
+ if ( headers_sent() ) {
+ echo "Headers already sent, terminating.\n";
+ return;
+ }
+
global $wgContLanguageCode;
header( "Content-Disposition:
inline;filename*=utf-8'$wgContLanguageCode'" . urlencode( basename( $fname ) )
);
@@ -53,25 +59,51 @@
}
/** */
-function wfGetType( $filename ) {
+function wfGetType( $filename, $safe = true ) {
global $wgTrivialMimeDetection;
+ $ext = strrchr($filename, '.');
+ $ext = $ext === false ? '' : strtolower( substr( $ext, 1 ) );
+
# trivial detection by file extension,
# used for thumbnails (thumb.php)
if ($wgTrivialMimeDetection) {
- $ext= strtolower(strrchr($filename, '.'));
-
switch ($ext) {
- case '.gif': return 'image/gif';
- case '.png': return 'image/png';
- case '.jpg': return 'image/jpeg';
- case '.jpeg': return 'image/jpeg';
+ case 'gif': return 'image/gif';
+ case 'png': return 'image/png';
+ case 'jpg': return 'image/jpeg';
+ case 'jpeg': return 'image/jpeg';
}
return 'unknown/unknown';
}
- else {
- $magic = MimeMagic::singleton();
- return $magic->guessMimeType($filename); //full fancy mime
detection
+
+ $magic = MimeMagic::singleton();
+ // Use the extension only, rather than magic numbers, to avoid opening
+ // up vulnerabilities due to uploads of files with allowed extensions
+ // but disallowed types.
+ $type = $magic->guessTypesForExtension( $ext );
+
+ /**
+ * Double-check some security settings that were done on upload but
might
+ * have changed since.
+ */
+ if ( $safe ) {
+ global $wgFileBlacklist, $wgCheckFileExtensions,
$wgStrictFileExtensions,
+ $wgFileExtensions, $wgVerifyMimeType,
$wgMimeTypeBlacklist, $wgRequest;
+ $form = new UploadForm( $wgRequest );
+ list( $partName, $extList ) = $form->splitExtensions( $filename
);
+ if ( $form->checkFileExtensionList( $extList, $wgFileBlacklist
) ) {
+ return 'unknown/unknown';
+ }
+ if ( $wgCheckFileExtensions && $wgStrictFileExtensions
+ && !$form->checkFileExtensionList( $extList,
$wgFileExtensions ) )
+ {
+ return 'unknown/unknown';
+ }
+ if ( $wgVerifyMimeType && in_array( strtolower( $type ),
$wgMimeTypeBlacklist ) ) {
+ return 'unknown/unknown';
+ }
}
+ return $type;
}
_______________________________________________
MediaWiki-CVS mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-cvs
