fix(Authoring): Check real mime type when author uploads a file #187
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hirokiterashima
requested changes
Nov 9, 2022
| return allowedTypes.contains(getRealMimeType(file)); | ||
| } | ||
|
|
||
| public String getRealMimeType(MultipartFile file) { |
There was a problem hiding this comment.
Suggested change
| public String getRealMimeType(MultipartFile file) { | |
| private String getRealMimeType(MultipartFile file) { |
Comment on lines
130
to
137
| try { | ||
| Metadata metadata = new Metadata(); | ||
| TikaInputStream stream = TikaInputStream.get(file.getInputStream()); | ||
| org.apache.tika.mime.MediaType mediaType = detector.detect(stream, metadata); | ||
| return mediaType.toString(); | ||
| } catch (IOException e) { | ||
| return MimeTypes.OCTET_STREAM; | ||
| } |
There was a problem hiding this comment.
If we add OCTET_STREAM to allowedTypes in application.properties, could this allow someone to potentially upload a file that we do not support?
To handle this case, should this method throw the IOException instead of returning a default OCTET_STREAM, and catch the exception in isUserAllowedToUpload() method and return false there?
hirokiterashima
approved these changes
Nov 9, 2022
breity
approved these changes
Nov 10, 2022
|
🎉 This PR is included in version 1.0.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
Check a file's real MIME type when an author uploads a file to the File Manager.
Test
Download the Burp Suite Community Edition (no need to enter email, just click "Go straight to downloads")
https://portswigger.net/burp/communitydownload
Install Burp Suite Community Edition
Launch Burp Suite Community Edition
Leave "Temporary project" selected
Use Burp defaults
Configure the proxy
Launch the browser
Upload a file that should not be allowed
Closes #186