Re: Image extension issue in mime.php
"Paul Lesniewski" <[email protected]>
| Newsgroups | gmane.mail.squirrelmail.devel |
|---|---|
| Message-ID | <[email protected]> |
>>>> - IE interprets JavaScript when served within an "image" (that is,
>>>> something linked from <img src="">. - Apparently (?) it doesn't do this
>>>> when the file has a regular image extension, it then processes it as an
>>>> image. A typical Windows way of working I guess.
>>>>
>>>
>>> Hmm. Can anyone confirm this? Are there any sample URIs that we can
>>> see for this?
>>>
>>> I tried this in IE6:
>>>
>>> <img src='javascript:alert("hello")' />
>>
>> The linked image file should contain the JavaScript. E.g.:
>> <img src='http://example.com/example.html' />
>> and then example.html contains javascript instead of an image. IE will
>> allegedly interpret the javascript in the file even though it has no
>> business doing that as it is an image.
>
> I see. IE interprets any JavaScript loaded in a remote file unless
> the extension is .png, .gif, etc....? That's a bit much, now, isn't
> it?
The only thing I can find is this:
http://ha.ckers.org/blog/20070623/hiding-js-in-valid-images/
but it's limited to the src attribute in a script tag. I created some
"hacked" gif files with JavaScript in them and IE 6 (I think this
might be fixed in IE 7 too) only executes the JavaScript when it's
included in a script tag. When you put that into an email, SM
sanitizes the script tag before the code in question here ever sees
it.
> If this is what we are fighting, then the extension list by
> definition of the way IE works seems like the ONLY way to prevent the
> problem, that is unless we were to pre-fetch the content and scan it
> ourselves and judge if the content was really an image file or not.
So, although I'm still not convinced that there should be any
restriction here at all, I created some code that does just this - it
keeps the file extension check since that's not resource intensive,
but if that test fails, it tries to fetch the resource (fopen, fread)
and then run the content through mime_content_type() to detect the
content type. The file is only then blocked if not an image file.
Patch is attached (for STABLE, but should be the same or very similar
for DEVEL), but again, I'm not sure we need to make any restrictions
here whatsoever -- ??
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel
check_image_content.diff
(application/octet-stream, 3.7 KB)
Index: functions/mime.php
===================================================================
--- functions/mime.php (revision 13265)
+++ functions/mime.php (working copy)
@@ -1745,7 +1745,48 @@
// validate image extension.
$ext = strtolower(substr($aUrl['path'],strrpos($aUrl['path'],'.')));
if (!in_array($ext,array('.jpeg','.jpg','xjpeg','.gif','.bmp','.jpe','.png','.xbm'))) {
- $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;
+ // If URI is to something other than
+ // a regular image file, get the contents
+ // and try to see if it is an image.
+ // Don't use Fileinfo (finfo_file()) because
+ // we'd need to make the admin configure the
+ // location of the magic.mime file (FIXME: add finfo_file() support later?)
+ //
+ $mime_type = '';
+ if (function_exists('mime_content_type')
+ && ($FILE = fopen($attvalue, 'rb', FALSE))) {
+
+ // fetch file
+ //
+ $file_contents = '';
+ while (!feof($FILE)) {
+ $file_contents .= fread($FILE, 8192);
+ }
+ fclose($FILE);
+
+ // store file locally
+ //
+ global $attachment_dir, $username;
+ $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
+ $localfilename = GenerateRandomString(32, '', 7);
+ $full_localfilename = "$hashed_attachment_dir/$localfilename";
+ while (file_exists($full_localfilename)) {
+ $localfilename = GenerateRandomString(32, '', 7);
+ $full_localfilename = "$hashed_attachment_dir/$localfilename";
+ }
+ $FILE = fopen("$hashed_attachment_dir/$localfilename", 'wb');
+ fwrite($FILE, $file_contents);
+ fclose($FILE);
+
+ // get mime type and remove file
+ //
+ $mime_type = mime_content_type("$hashed_attachment_dir/$localfilename");
+ unlink("$hashed_attachment_dir/$localfilename");
+ }
+ // debug: echo "$attvalue FILE TYPE IS $mime_type<HR>";
+ if (substr(strtolower($mime_type), 0, 5) != 'image') {
+ $attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;
+ }
}
} else {
$attvalue = $sQuote . SM_PATH . 'images/blank.png'. $sQuote;