mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Sanitize custom map SVGs (#16448)

Browse Source 
https://github.com/librenms/librenms/security/advisories/GHSA-x8gm-j36p-fppf

Will only sanitize new SVGs. If you have existing backgrounds, they will not be sanitized.
XSS cannot be triggered within the LibreNMS UI, to trigger, you must directly visit the background image URL.
This commit is contained in:
Tony Murray
2024-09-29 08:17:21 -05:00
committed by GitHub
parent 36b38a50cc
commit d959bf1b36
3 changed files with 60 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
app/Http/Controllers/Maps/CustomMapBackgroundController.php
View File

@@ -28,6 +28,7 @@ namespace App\Http\Controllers\Maps;
use App\Http\Controllers\Controller;
use App\Models\CustomMap;
use App\Models\CustomMapBackground;
use enshrined\svgSanitize\Sanitizer;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Facades\Cache;
@@ -96,13 +97,23 @@ class CustomMapBackgroundController extends Controller
if ($request->image) {
// if image type and we have image data (new image) save it
$background = $map->background ?? new CustomMapBackground;
$background->background_image = $request->image->getContent();
$image_content = $request->image->getContent();
$mimeType = $request->image->getMimeType();
// sanitize SVGs
if ($mimeType == 'image/svg+xml') {
$image_content = (new Sanitizer)->sanitize($image_content);
}
$background->background_image = $image_content;
$map->background()->save($background);
Cache::driver('file')->forget($this->getCacheKey($map)); // clear old image cache if present
$map->background_data = array_merge($map->background_data ?? [], [
'version' => md5($background->background_image),
'original_filename' => $request->image->getClientOriginalName(),
'mime' => $request->image->getMimeType(),
'mime' => $mimeType,
]);
}
} elseif ($map->getOriginal('background_type') == 'image') {