57 lines
2.0 KiB
Plaintext
57 lines
2.0 KiB
Plaintext
---
|
|
summary: Address the security risks around MXC URIs
|
|
---
|
|
assignee: kegan
|
|
created: 2015-05-27 10:28:37.0
|
|
creator: kegan
|
|
description: |-
|
|
{code}
|
|
<M-Matthew> do we have an *enormous* security hole in mxc:// URLs, in terms of letting HSes request arbitrary content? (and so expose their private HTTP space?)
|
|
<M-Matthew> i was pondering an attack of flavour mxc://127.0.0.1/../../../some_service/etc/passwd
|
|
<M-Mjark> We don't allow "/" in the content-id part.
|
|
{code}
|
|
|
|
This is a problem: particularly since the request will be made by the target HS (which may be on a private network).
|
|
|
|
The Security section of the content repository docs does not address manipulating the paths of MXC URIs. We should be explicitly addressing this (e.g. the path segment extracted from the URL of the request should be restricted to protect against directory traversal attacks. Passing through a regex is strongly advised given the sheer amount of odd representations of {{../}} e.g. percent-encoded like {{%2e%2e%2f}} or UTF-8 encoded traversals like {{%c1%1c}}
|
|
id: '11562'
|
|
key: SPEC-165
|
|
number: '165'
|
|
priority: '1'
|
|
project: '10001'
|
|
reporter: kegan
|
|
resolution: '1'
|
|
resolutiondate: 2015-10-14 15:28:57.0
|
|
status: '5'
|
|
type: '1'
|
|
updated: 2015-10-14 15:28:57.0
|
|
votes: '0'
|
|
watches: '2'
|
|
workflowId: '11663'
|
|
---
|
|
actions:
|
|
- author: markjh
|
|
body: I'd propose that at the very least we should allow "[-_0-9A-Za-z]" to allow the url-safe base64 specified in http://tools.ietf.org/html/rfc4648.
|
|
created: 2015-05-27 10:40:50.0
|
|
id: '11796'
|
|
issue: '11562'
|
|
type: comment
|
|
updateauthor: markjh
|
|
updated: 2015-05-27 10:40:50.0
|
|
- author: kegan
|
|
body: Sounds good to me.
|
|
created: 2015-05-27 10:52:46.0
|
|
id: '11797'
|
|
issue: '11562'
|
|
type: comment
|
|
updateauthor: kegan
|
|
updated: 2015-05-27 10:52:46.0
|
|
- author: kegan
|
|
body: https://github.com/matrix-org/matrix-doc/pull/103
|
|
created: 2015-10-14 15:28:57.0
|
|
id: '12265'
|
|
issue: '11562'
|
|
type: comment
|
|
updateauthor: kegan
|
|
updated: 2015-10-14 15:28:57.0
|