Elijah/drive
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: implement Phase 1 and 2 security remediations
Some checks failed
Automated Container Build / build-and-push (push) Has been cancelled
Details

Browse source
This commit is contained in:
Elijah 2026-05-26 13:32:09 -07:00
parent 82731e93b1
commit 701766b611
14 changed files with 213 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

10
backend/workers/tasks.go
View file

@ -208,9 +208,13 @@ func UnzipAsync(taskID string, sourceFull, destFolder string) {
for i, f := range r.File {
// Prevent Zip Slip vulnerability
fpath := filepath.Join(destFolder, f.Name)
if !strings.HasPrefix(fpath, filepath.Clean(destFolder)+string(os.PathSeparator)) {
continue // Skip malicious paths
fpath := filepath.Join(destFolder, filepath.FromSlash(f.Name))
absDestFolder, _ := filepath.Abs(destFolder)
absFpath, _ := filepath.Abs(fpath)
if !strings.HasPrefix(absFpath, absDestFolder+string(os.PathSeparator)) {
Tasks.FailTask(taskID, fmt.Errorf("zip slip detected: %s attempts to escape to %s", f.Name, absFpath))
return
}
if f.FileInfo().IsDir() {

12
backend/workers/thumbnails.go
View file

@ -213,17 +213,14 @@ func generateAudioThumbnail(src, dest string) error {
func generateOfficeThumbnail(filePath, destPath string, cfg *config.Config) error {
// Generate a download token for the Conversion API to fetch the file from our backend
token, err := middleware.GenerateDownloadToken(0, "system_worker", cfg.JWTSecret)
token, err := middleware.GenerateDownloadToken(0, "system_worker", cfg.JWTSecret, filePath)
if err != nil {
return fmt.Errorf("failed to generate download token: %w", err)
}
// Assuming backend runs on port from config, but we need the external URL or internal docker URL that Document Server can reach.
// Since we saw in OnlyOfficeEditor that the Document Server can reach the host at 192.168.50.81:5827, we use that.
// We'll try to build a robust URL.
hostIP := "192.168.50.81" // Hardcoded as per OnlyOfficeEditor.tsx implementation for this specific deployment
port := cfg.Port
fileUrl := fmt.Sprintf("http://%s:%s/api/public/onlyoffice/download?path=%s&token=%s", hostIP, port, url.QueryEscape(filePath), token)
internalURL := cfg.InternalAPIURL
fileUrl := fmt.Sprintf("%s/public/onlyoffice/download?path=%s&token=%s", internalURL, url.QueryEscape(filePath), token)
ext := strings.TrimPrefix(filepath.Ext(filePath), ".")
if ext == "" {
@ -344,7 +341,8 @@ func generateOfficeThumbnail(filePath, destPath string, cfg *config.Config) erro
}
// Download the resulting image
imgResp, err := http.Get(finalImgUrl)
client := &http.Client{Timeout: 30 * time.Second}
imgResp, err := client.Get(finalImgUrl)
if err != nil {
return fmt.Errorf("failed to download converted image: %w", err)
}