EMPT-41: Prevent upload of executable and script files. #54

jnsereko · 2021-04-26T11:16:21Z

Basing on the discussion we had at https://talk.openmrs.org/t/attachment-functionality-of-openmrs-reference-application-is-vulnerable/33208/7.

this functionality is to prevent upload of an executable or a script in order to prevent vulnerabilities in this module.
I haven't created any ticket for this feature. That is the reason why i haven't attached its link here.

cc @isears @HerbertYiga @sherrif10

jnsereko · 2021-04-26T11:20:43Z

api/src/main/java/org/openmrs/module/attachments/AttachmentsContext.java

@@ -345,6 +345,12 @@ public static double getCompressionRatio(double fileByteSize, double maxByteSize
 	 */
 	public static ContentFamily getContentFamily(String mimeType) {
 		ContentFamily contentFamily = ContentFamily.OTHER;
+		if (StringUtils.equals(mimeType, "some type")) {


Unfortunately i haven't been able to get the correct MIME type for all executables.
i think that i could use application/octet-stream according to https://www.lifewire.com/file-extensions-and-mime-types-3469109 but i think it isn't right basing on the iana media types

@jnsereko maybe take it the other way around. Think of a couple of obviously insecure file types (.js, .exe, .sh, .sql, ... etc) and see what the MIME types are for those guys, and start building an exclusion list that way.
You could probably start with:

application/octet-stream

text/javascript (and its cousins, see here).

@isears @ibacher?

Yes, just denying the upload of aplication/octet-stream and text/javascript would be a big improvement over what we have now (which is no filtering).

Building that initial functionality is the difficult part. Once we have it for one or two mime-types we can always extend it to include others if we need to.

jnsereko · 2021-04-26T11:21:05Z

api/src/main/java/org/openmrs/module/attachments/AttachmentsContext.java

+		if (StringUtils.equals(mimeType, "some type")) {
+			contentFamily = ContentFamily.EXECUTABLE;
+		}
+		if (StringUtils.equals(mimeType, "some type")) {


Unfortunately i haven't been able to get the correct MIME type for all scripts.

why not simply check the type you wana exclude here and return the appropriate message

openmrs-module-attachments/omod-1.10/src/main/java/org/openmrs/module/attachments/rest/AttachmentResource1_10.java

Line 100 in bd8f77b

public Object upload(MultipartFile file, RequestContext context) throws ResponseException, IOException {

mks-d · 2021-04-26T14:39:42Z

api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java

@@ -12,6 +12,8 @@
 public class AttachmentsConstants {

 	public static enum ContentFamily {
+		EXECUTABLE,
+		SCRIPT,


@jnsereko you basically treat everything as executables in this PR, there is no reason to distinguish scripts from executables.

oohh.. great suggestion @mks-d. Thanks

mks-d · 2021-04-26T14:50:29Z

api/src/main/java/org/openmrs/module/attachments/AttachmentsContext.java

@@ -345,6 +345,12 @@ public static double getCompressionRatio(double fileByteSize, double maxByteSize
 	 */
 	public static ContentFamily getContentFamily(String mimeType) {
 		ContentFamily contentFamily = ContentFamily.OTHER;
+		if (StringUtils.equals(mimeType, "some type")) {


@jnsereko maybe take it the other way around. Think of a couple of obviously insecure file types (.js, .exe, .sh, .sql, ... etc) and see what the MIME types are for those guys, and start building an exclusion list that way.
You could probably start with:

application/octet-stream

text/javascript (and its cousins, see here).

@isears @ibacher?

sherrif10 · 2021-04-28T20:55:16Z

Thanks @jnsereko for the awesome work, Since this ticket is worth doing, i think its ok to create a ticket in jira for it and update it here with the ticket id, Also the branch name should reflect ATTACHMENT tag cc @isears @mks-d

mks-d

Please add some tests as well.

mks-d · 2021-04-28T22:34:41Z

api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java

@@ -70,7 +69,9 @@
 	public static final String INSTRUCTIONS_PREFIX = "instructions";

 	public static final String UNKNOWN_MIME_TYPE = "application/octet-stream";
-
+
+	public static final String[] EXECUTABLE_MIME_TYPE = {"application/octet-stream", "type/javascript"};


public static final List<String> EXECUTABLE_MIME_TYPES = Arrays.asList("application/octet-stream", "type/javascript");

(TYPES, plural)

mks-d · 2021-04-28T22:36:03Z

api/src/main/java/org/openmrs/module/attachments/AttachmentsContext.java

+		if (getMimeType(mimeType)) {
 			contentFamily = ContentFamily.EXECUTABLE;
 		}


if (EXECUTABLE_MIME_TYPES.contains(mimeType)) { contentFamily = ContentFamily.EXECUTABLE; }

I have implemented suggestions and added tests. Thanks

cc @mks-d @isears @sherrif10

api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java

jnsereko · 2021-04-30T14:58:32Z

Thanks @mks-d @isears @sherrif10 @HerbertYiga for reviewing this. I have added mime types for .py files, .jar files, .php files, .sh files, .exe files, .sql files, and visual basic files

api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java

...1.10/src/test/java/org/openmrs/module/attachments/rest/AttachmentRestController1_10Test.java

omod-1.10/src/main/java/org/openmrs/module/attachments/rest/AttachmentResource1_10.java

mks-d · 2021-05-03T09:55:46Z

api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java

@@ -69,6 +73,9 @@

 	public static final String UNKNOWN_MIME_TYPE = "application/octet-stream";

+	public static final List<String> EXECUTABLE_MIME_TYPES = Arrays.asList("application/vnd.microsoft.portable-executable",
+	    "text/javascript", "application/javascript", "application/sql", "application/x-sh", "application/java-archive" "application/x-httpd-php","application/x-vbs", "application/x-python-code", "text/vbscript", "text/x-python");


@isears @ibacher, does it look like a decent shortlist of bad guys?

It seems like mimetypes can get pretty crazy, but maybe we should add in application/x-ms-installer and application/x-elf as well @jnsereko

I'd probably drop application/sql from the list. Also, a few additions:

application/x-applescript

application/x-ruby

application/x-perl

application/wasm

That should cover many of the more common scripting languages (I can't find any even semi-standard MIME Types for batch and ps1 files).

Hello @ibacher i have removed the application/sql mime type added added more as you suggested. I guess this catch is good for the start.
@mks-d @isears @sherrif10 @dkayiwa

omod-1.10/src/main/java/org/openmrs/module/attachments/rest/AttachmentResource1_10.java

mks-d · 2021-05-10T10:47:31Z

...1.10/src/test/java/org/openmrs/module/attachments/rest/AttachmentRestController1_10Test.java

@@ -439,6 +439,27 @@ public void postAttachment_shouldNotUploadFileAboveSizeLimit() throws Exception
 		SimpleObject response = deserialize(handle(request));
 	}

+	@Test(expected = IllegalRequestException.class)
+	public void postAttachment_shouldNotUplodExecutbleFile() throws Exception {


There's a typo here by maybe rename this to postAttachment_shouldThrowOnExecutableFile.

hey @mks-d I have changed the test method name..

jnsereko commented Apr 26, 2021

View reviewed changes

mks-d reviewed Apr 26, 2021

View reviewed changes

mks-d changed the title ~~EMPT-41: Prevent upload of executable and script files~~ EMPT-41: Prevent upload of executable and script files. Apr 26, 2021

mks-d requested changes Apr 28, 2021

View reviewed changes

jnsereko commented Apr 29, 2021

View reviewed changes

api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java Show resolved Hide resolved

jnsereko requested a review from mks-d April 29, 2021 19:25

mks-d requested changes Apr 29, 2021

View reviewed changes

api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java Show resolved Hide resolved

jnsereko requested a review from mks-d April 30, 2021 14:54

ibacher reviewed Apr 30, 2021

View reviewed changes

api/src/main/java/org/openmrs/module/attachments/AttachmentsConstants.java Outdated Show resolved Hide resolved

ibacher reviewed Apr 30, 2021

View reviewed changes

...1.10/src/test/java/org/openmrs/module/attachments/rest/AttachmentRestController1_10Test.java Outdated Show resolved Hide resolved

ibacher reviewed Apr 30, 2021

View reviewed changes

omod-1.10/src/main/java/org/openmrs/module/attachments/rest/AttachmentResource1_10.java Show resolved Hide resolved

mks-d reviewed May 3, 2021

View reviewed changes

jnsereko force-pushed the EMPT-41 branch 4 times, most recently from 49d452c to 39033f9 Compare May 5, 2021 10:03

jnsereko requested a review from mks-d May 6, 2021 13:34

mks-d requested changes May 10, 2021

View reviewed changes

EMPT-41: Prevent upload of executable and script files.

8a34532

jnsereko force-pushed the EMPT-41 branch from 39033f9 to 8a34532 Compare May 10, 2021 17:42

jnsereko requested a review from mks-d May 11, 2021 08:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

EMPT-41: Prevent upload of executable and script files. #54

EMPT-41: Prevent upload of executable and script files. #54

jnsereko commented Apr 26, 2021

jnsereko Apr 26, 2021

mks-d Apr 26, 2021

isears Apr 28, 2021

jnsereko Apr 26, 2021

HerbertYiga Apr 26, 2021 •

edited

mks-d Apr 26, 2021

jnsereko Apr 26, 2021

mks-d Apr 26, 2021

sherrif10 commented Apr 28, 2021 •

edited

mks-d left a comment

mks-d Apr 28, 2021

mks-d Apr 28, 2021 •

edited

jnsereko Apr 29, 2021

jnsereko commented Apr 30, 2021

mks-d May 3, 2021

isears May 3, 2021

ibacher May 4, 2021

jnsereko May 6, 2021

mks-d May 10, 2021

jnsereko May 11, 2021

EMPT-41: Prevent upload of executable and script files. #54

Are you sure you want to change the base?

EMPT-41: Prevent upload of executable and script files. #54

Conversation

jnsereko commented Apr 26, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

HerbertYiga Apr 26, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sherrif10 commented Apr 28, 2021 • edited

mks-d left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mks-d Apr 28, 2021 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jnsereko commented Apr 30, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

HerbertYiga Apr 26, 2021 •

edited

sherrif10 commented Apr 28, 2021 •

edited

mks-d Apr 28, 2021 •

edited