From 7d624c4750dcf53d48cc65874c832513f2b03fbc Mon Sep 17 00:00:00 2001 From: "Haelwenn (lanodan) Monnier" Date: Tue, 20 Feb 2024 08:45:48 +0100 Subject: [PATCH 1/2] StealEmojiPolicy: Sanitize shortcodes Closes: https://git.pleroma.social/pleroma/pleroma/-/issues/3245 --- changelog.d/mrf_steal_emoji-path.security | 1 + .../activity_pub/mrf/steal_emoji_policy.ex | 2 ++ .../mrf/steal_emoji_policy_test.exs | 26 +++++++++++++++++++ 3 files changed, 29 insertions(+) create mode 100644 changelog.d/mrf_steal_emoji-path.security diff --git a/changelog.d/mrf_steal_emoji-path.security b/changelog.d/mrf_steal_emoji-path.security new file mode 100644 index 000000000..d880680d1 --- /dev/null +++ b/changelog.d/mrf_steal_emoji-path.security @@ -0,0 +1 @@ +StealEmojiPolicy: Sanitize shortcodes (thanks to Hazel K for the report) \ No newline at end of file diff --git a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex index 237dfefa5..fa6b595ea 100644 --- a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex +++ b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex @@ -36,6 +36,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do extension = if extension == "", do: ".png", else: extension + shortcode = Path.basename(shortcode) file_path = Path.join(emoji_dir_path, shortcode <> extension) case File.write(file_path, response.body) do @@ -78,6 +79,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do new_emojis = foreign_emojis |> Enum.reject(fn {shortcode, _url} -> shortcode in installed_emoji end) + |> Enum.reject(fn {shortcode, _url} -> String.contains?(shortcode, ["/", "\\"]) end) |> Enum.filter(fn {shortcode, _url} -> reject_emoji? = [:mrf_steal_emoji, :rejected_shortcodes] diff --git a/test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs b/test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs index c477a093d..2c7497da5 100644 --- a/test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs +++ b/test/pleroma/web/activity_pub/mrf/steal_emoji_policy_test.exs @@ -87,6 +87,32 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicyTest do assert File.exists?(fullpath) end + test "rejects invalid shortcodes", %{path: path} do + message = %{ + "type" => "Create", + "object" => %{ + "emoji" => [{"fired/fox", "https://example.org/emoji/firedfox"}], + "actor" => "https://example.org/users/admin" + } + } + + fullpath = Path.join(path, "fired/fox.png") + + Tesla.Mock.mock(fn %{method: :get, url: "https://example.org/emoji/firedfox"} -> + %Tesla.Env{status: 200, body: File.read!("test/fixtures/image.jpg")} + end) + + clear_config(:mrf_steal_emoji, hosts: ["example.org"], size_limit: 284_468) + + refute "firedfox" in installed() + refute File.exists?(path) + + assert {:ok, _message} = StealEmojiPolicy.filter(message) + + refute "fired/fox" in installed() + refute File.exists?(fullpath) + end + test "reject regex shortcode", %{message: message} do refute "firedfox" in installed() From e149ee6e225667ca964e30a08179ca84b8537aaf Mon Sep 17 00:00:00 2001 From: "Haelwenn (lanodan) Monnier" Date: Tue, 20 Feb 2024 09:16:36 +0100 Subject: [PATCH 2/2] Mergeback of security release 2.6.2 --- CHANGELOG.md | 5 +++++ changelog.d/mergeback-2.6.2.skip | 0 changelog.d/mrf_steal_emoji-path.security | 1 - mix.exs | 2 +- 4 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 changelog.d/mergeback-2.6.2.skip delete mode 100644 changelog.d/mrf_steal_emoji-path.security diff --git a/CHANGELOG.md b/CHANGELOG.md index e071fe693..063d51d4c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). +## 2.6.2 + +### Security +- MRF StealEmojiPolicy: Sanitize shortcodes (thanks to Hazel K for the report + ## 2.6.1 ### Changed - - Document maximum supported version of Erlang & Elixir diff --git a/changelog.d/mergeback-2.6.2.skip b/changelog.d/mergeback-2.6.2.skip new file mode 100644 index 000000000..e69de29bb diff --git a/changelog.d/mrf_steal_emoji-path.security b/changelog.d/mrf_steal_emoji-path.security deleted file mode 100644 index d880680d1..000000000 --- a/changelog.d/mrf_steal_emoji-path.security +++ /dev/null @@ -1 +0,0 @@ -StealEmojiPolicy: Sanitize shortcodes (thanks to Hazel K for the report) \ No newline at end of file diff --git a/mix.exs b/mix.exs index 582092aef..b707a20a8 100644 --- a/mix.exs +++ b/mix.exs @@ -4,7 +4,7 @@ defmodule Pleroma.Mixfile do def project do [ app: :pleroma, - version: version("2.6.51"), + version: version("2.6.52"), elixir: "~> 1.11", elixirc_paths: elixirc_paths(Mix.env()), compilers: Mix.compilers(),