Nemcio/Grav
1
0
Fork 0
mirror of https://github.com/getgrav/grav.git synced 2025-10-26 07:56:07 +01:00
Code Issues Packages Projects Releases Activity

Update dangerous extensions (#3756)

Browse Source 
Thanks for this!
This commit is contained in:
Jeremy Angele
2023-10-24 11:20:22 +02:00
committed by GitHub
parent f0f29891d6
commit 80ce87e4a9
9 changed files with 22 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
system/config/security.yaml
View File

@@ -32,9 +32,16 @@ xss_dangerous_tags:
- base - base
uploads_dangerous_extensions: uploads_dangerous_extensions:
- php - php
- php2
- php3
- php4
- php5
- phar - phar
- phtml
- html - html
- htm - htm
- shtml
- shtm
- js - js
- exe - exe
sanitize_svg: true sanitize_svg: true

4
system/src/Grav/Common/Utils.php
View File

@@ -977,10 +977,10 @@ abstract class Utils
* @param string $filename * @param string $filename
* @return bool * @return bool
*/ */
public static function checkFilename($filename) public static function checkFilename($filename): bool
{ {
$dangerous_extensions = Grav::instance()['config']->get('security.uploads_dangerous_extensions', []); $dangerous_extensions = Grav::instance()['config']->get('security.uploads_dangerous_extensions', []);
$extension = static::pathinfo($filename, PATHINFO_EXTENSION); $extension = strtolower(static::pathinfo($filename, PATHINFO_EXTENSION));
return !( return !(
// Empty filenames are not allowed. // Empty filenames are not allowed.

1
tests/unit/Grav/Common/UtilsTest.php
View File

@@ -561,6 +561,7 @@ class UtilsTest extends \Codeception\TestCase\Test
$config->set('security.uploads_dangerous_extensions', ['php', 'html', 'htm', 'exe', 'js']); $config->set('security.uploads_dangerous_extensions', ['php', 'html', 'htm', 'exe', 'js']);
self::assertFalse(Utils::checkFilename('foo.php')); self::assertFalse(Utils::checkFilename('foo.php'));
self::assertFalse(Utils::checkFilename('foo.PHP'));
self::assertFalse(Utils::checkFilename('bar.js')); self::assertFalse(Utils::checkFilename('bar.js'));
self::assertTrue(Utils::checkFilename('foo.json')); self::assertTrue(Utils::checkFilename('foo.json'));

4
webserver-configs/Caddyfile
View File

@@ -16,10 +16,10 @@ php_fastcgi 127.0.0.1:9000
rewrite /(\.git|cache|bin|logs|backups|tests)/.* /403 rewrite /(\.git|cache|bin|logs|backups|tests)/.* /403
# deny running scripts inside core system folders # deny running scripts inside core system folders
rewrite /(system|vendor)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ /403 rewrite /(system|vendor)/.*\.(txt|xml|md|html|htm|shtml|shtm|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ /403
# deny running scripts inside user folder # deny running scripts inside user folder
rewrite /user/.*\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ /403 rewrite /user/.*\.(txt|md|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ /403
# deny access to specific files in the root folder # deny access to specific files in the root folder
rewrite /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) /403 rewrite /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) /403

4
webserver-configs/Caddyfile-0.8.x
View File

@@ -12,12 +12,12 @@ rewrite {
} }
# deny running scripts inside core system folders # deny running scripts inside core system folders
rewrite { rewrite {
r /(system|vendor)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ r /(system|vendor)/.*\.(txt|xml|md|html|htm|shtml|shtm|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$
status 403 status 403
} }
# deny running scripts inside user folder # deny running scripts inside user folder
rewrite { rewrite {
r /user/.*\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ r /user/.*\.(txt|md|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$
status 403 status 403
} }
# deny access to specific files in the root folder # deny access to specific files in the root folder

4
webserver-configs/htaccess.txt
View File

@@ -59,9 +59,9 @@ RewriteRule .* index.php [L]
# Block all direct access for these folders # Block all direct access for these folders
RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F] RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
# Block access to specific file types for these system folders # Block access to specific file types for these system folders
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ error [F] RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F]
# Block access to specific file types for these user folders # Block access to specific file types for these user folders
RewriteRule ^(user)/(.*)\.(txt|md|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ error [F] RewriteRule ^(user)/(.*)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ error [F]
# Block all direct access to .md files: # Block all direct access to .md files:
RewriteRule \.md$ error [F] RewriteRule \.md$ error [F]
# Block all direct access to files and folders beginning with a dot # Block all direct access to files and folders beginning with a dot

2
webserver-configs/lighttpd.conf
View File

@@ -33,7 +33,7 @@ $HTTP["url"] =~ "^/grav_path/(LICENSE\.txt|composer\.json|composer\.lock|nginx\.
$HTTP["url"] =~ "^/grav_path/(\.git|cache|bin|logs|backup|tests)/(.*)" { $HTTP["url"] =~ "^/grav_path/(\.git|cache|bin|logs|backup|tests)/(.*)" {
url.access-deny = ("") url.access-deny = ("")
} }
$HTTP["url"] =~ "^/grav_path/(system|user|vendor)/(.*)\.(txt|md|html|json|yaml|yml|php|twig|sh|bat)$" { $HTTP["url"] =~ "^/grav_path/(system|user|vendor)/(.*)\.(txt|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|twig|sh|bat)$" {
url.access-deny = ("") url.access-deny = ("")
} }
$HTTP["url"] =~ "^/grav_path/(\.(.*))" { $HTTP["url"] =~ "^/grav_path/(\.(.*))" {

4
webserver-configs/nginx.conf
View File

@@ -20,9 +20,9 @@ server {
# deny all direct access for these folders # deny all direct access for these folders
location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; } location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
# deny running scripts inside core system folders # deny running scripts inside core system folders
location ~* /(system|vendor)/.*\.(txt|xml|md|html|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; } location ~* /(system|vendor)/.*\.(txt|xml|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ { return 403; }
# deny running scripts inside user folder # deny running scripts inside user folder
location ~* /user/.*\.(txt|md|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; } location ~* /user/.*\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$ { return 403; }
# deny access to specific files in the root folder # deny access to specific files in the root folder
location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; } location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
## End - Security ## End - Security

6
webserver-configs/web.config
View File

@@ -18,7 +18,7 @@
<action type="Rewrite" url="index.php" /> <action type="Rewrite" url="index.php" />
</rule> </rule>
<rule name="user_error_redirect" stopProcessing="true"> <rule name="user_error_redirect" stopProcessing="true">
<match url="^(user)/(.*)\.(txt|md|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$" ignoreCase="false" /> <match url="^(user)/(.*)\.(txt|md|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|pl|py|cgi|twig|sh|bat)$" ignoreCase="false" />
<action type="Redirect" url="error" redirectType="Permanent" /> <action type="Redirect" url="error" redirectType="Permanent" />
</rule> </rule>
<rule name="ignore_folders" stopProcessing="true"> <rule name="ignore_folders" stopProcessing="true">
@@ -26,11 +26,11 @@
<action type="Redirect" url="error" redirectType="Permanent" /> <action type="Redirect" url="error" redirectType="Permanent" />
</rule> </rule>
<rule name="system" stopProcessing="true"> <rule name="system" stopProcessing="true">
<match url="^system/(.*)\.(txt|md|html|json|yaml|yml|php|twig|sh|bat)$" ignoreCase="false" /> <match url="^system/(.*)\.(txt|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|twig|sh|bat)$" ignoreCase="false" />
<action type="Redirect" url="error" redirectType="Permanent" /> <action type="Redirect" url="error" redirectType="Permanent" />
</rule> </rule>
<rule name="vendor" stopProcessing="true"> <rule name="vendor" stopProcessing="true">
<match url="^vendor/(.*)\.(txt|md|html|json|yaml|yml|php|twig|sh|bat)$" ignoreCase="false" /> <match url="^vendor/(.*)\.(txt|md|html|htm|shtml|shtm|json|yaml|yml|php|php2|php3|php4|php5|phar|phtml|twig|sh|bat)$" ignoreCase="false" />
<action type="Redirect" url="error" redirectType="Permanent" /> <action type="Redirect" url="error" redirectType="Permanent" />
</rule> </rule>
</rules> </rules>