Repository navigation
fix(security): block direct access to uploaded demos - #78
Merged
Merged
Conversation
Cherry-pick of upstream sbpp#1608 (60d822f) and sbpp#1610 (120209b). Name uploaded demos from a CSPRNG, deny direct /demos/ access in the Apache confs and a shipped .htaccess, and send X-Content-Type-Options: nosniff on every response. Demos (including uploads from the anonymous submission form) are stored without an extension; serving them straight from /demos/ let a browser sniff them as HTML. The public submit form also named the file md5(SteamID . time()), which is guessable. sbpp#1610 makes demos/ writable in the dev web container so uploads keep working under the new layout. Fork adaptations: - page.submit.php keeps the fork's empty-upload guard around move_uploaded_file(); - AGENTS.md / docker/README.md keep the fork's rows (srcdslab image name, dev-prepend description); the CLA row is not carried over. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of upstream sbpp#1608 and sbpp#1610.
Problem
Uploaded demos (including uploads from the anonymous Submit a ban form) are stored without an extension in
web/demos/, which was directly reachable over HTTP. A browser could content-sniff an uploaded file as HTML. The public form also named filesmd5(SteamID . time()), which is guessable.Fix
UploadHandler::randomDiskName()(CSPRNG, 32-char hex) for both upload paths.demos/denied indocker/apache/sbpp-prod.conf, a newdocker/apache/sbpp-dev.conf, and a shippedweb/demos/.htaccess(whitelisted in.gitignore, checked in the release zip).getdemo.phpstays the only download path.X-Content-Type-Options: nosniffon every response (init.php+ both Apache confs).demos/is writable in the dev web container.Fork adaptations
page.submit.phpkeeps the fork's empty-upload guard.Tests
DemoUploadHardening|UploadHandler|Submit|ProdApacheConfig|GetDemo: 18 tests OK.apache2 -twith the new dev conf: Syntax OK. The new E2E specdemo-direct-access.spec.tsneeds a rebuilt dev image (the conf is baked in), not run locally.Self-hosters on nginx / IIS need to add the deny rule themselves (documented in the quickstart).
CHANGELOG: 2.2.2-srcdslab.