fix: decompression bomb attack in the Filer #1426
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Filer allowed for the images for very high pixels (height * width) to be
uploaded. This would cause crash and failures when the high pixels
exceeded what is allowed by Pillow Image MAX_IMAGE_PIXELS value.
This is an issue because even though the image is possible to be created
and attached to the page, it would never work as PIL always fails to
thumbnails such high pixel image and crashes causing crash and high
memory usages in such pages.
This patch, fixes this issues in the bud as it wouldn't allow such files
to be uploaded via FILER itself. It also allows to set a lower limit
FILER_MAX_IMAGE_PIXELS so that users can limit the max pixels to value
much lower than what PIL support.
- Github Issue
- #1425
- #1330
Authored-by: Vinit Kumar <vinit.kumar@kidskonnect.nl>
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## master #1426 +/- ##
==========================================
+ Coverage 75.96% 76.41% +0.44%
==========================================
Files 75 75
Lines 3454 3510 +56
Branches 554 562 +8
==========================================
+ Hits 2624 2682 +58
+ Misses 669 666 -3
- Partials 161 162 +1
☔ View full report in Codecov by Sentry. |
fsbraun
requested changes
Sep 25, 2023
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return JsonResponse(data) | ||
| except Exception as error: | ||
| messages.error(request, str(error)) | ||
| return JsonResponse({"error": str(error)}) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
|
@fsbraun Just checked it out. Looks and work great. Except I think this warning message could be better. Is show
|
…-filer into fix/decompression-bomb
fsbraun
approved these changes
Sep 28, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Filer allowed for the images for very high pixels (height * width) to be uploaded. This would cause crash and failures when the high pixels exceeded what is allowed by Pillow Image MAX_IMAGE_PIXELS value.
This is an issue because even though the image is possible to be created and attached to the page, it would never work as PIL always fails to thumbnails such high pixel image and crashes causing crash and high memory usages in such pages.
This patch, fixes this issues in the bud as it wouldn't allow such files to be uploaded via FILER itself. It also allows to set a lower limit FILER_MAX_IMAGE_PIXELS so that users can limit the max pixels to value much lower than what PIL support.
We also choose the pixel value rather than MAX_HEIGHT and MAX_WIDTH to allow different resolutions of image other than square images.
filerdecompressionbomb.mov
Github Issue
Authored-by: Vinit Kumar vinit.kumar@kidskonnect.nl
Related resources
Checklist
masterSlack to find a “pr review buddy” who is going to review my pull request.