From c4a7625584e550a30978d747e54a4be8232952d4 Mon Sep 17 00:00:00 2001 From: Colin Verot Date: Fri, 17 Nov 2023 16:24:14 +0100 Subject: [PATCH 1/4] fix namespace use --- README.md | 4 ++-- src/class.upload.php | 2 +- test/upload.php | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index f959087..80c186b 100644 --- a/README.md +++ b/README.md @@ -89,10 +89,10 @@ Don't forget to add `enctype="multipart/form-data"` in your form tag `
` if ### Namespacing -The class is now namespaced in the `Verot/Upload` namespace. If you have the error *Fatal error: Class 'Upload' not found*, then make sure your file belongs to the namespace, or instantiate the class with its fully qualified name: +The class is now namespaced in the `Verot/Upload` namespace. If you have the error *Fatal error: Class 'Upload' not found*, then `use` the class fully qualified name, or instantiate the class with its fully qualified name: ```php -namespace Verot\Upload; +use Verot\Upload\Upload; $handle = new Upload($_FILES['image_field']); ``` or diff --git a/src/class.upload.php b/src/class.upload.php index 524f19a..8de413f 100755 --- a/src/class.upload.php +++ b/src/class.upload.php @@ -2118,7 +2118,7 @@ function __construct($file, $lang = 'en_GB') { */ function upload($file, $lang = 'en_GB') { - $this->version = '09/12/2022'; + $this->version = '17/11/2023'; $this->file_src_name = ''; $this->file_src_name_body = ''; diff --git a/test/upload.php b/test/upload.php index 4906743..8b44ff3 100644 --- a/test/upload.php +++ b/test/upload.php @@ -1,5 +1,5 @@ Date: Fri, 17 Nov 2023 16:32:51 +0100 Subject: [PATCH 2/4] fix end of files --- src/class.upload.php | 2 -- src/lang/class.upload.ar_EG.php | 1 - src/lang/class.upload.tr_TR.php | 1 - 3 files changed, 4 deletions(-) diff --git a/src/class.upload.php b/src/class.upload.php index 8de413f..40d9c28 100755 --- a/src/class.upload.php +++ b/src/class.upload.php @@ -5239,5 +5239,3 @@ function imagebmp(&$im, $filename = "") { return true; } } - -?> diff --git a/src/lang/class.upload.ar_EG.php b/src/lang/class.upload.ar_EG.php index 3de578b..299a758 100644 --- a/src/lang/class.upload.ar_EG.php +++ b/src/lang/class.upload.ar_EG.php @@ -84,4 +84,3 @@ $translation['no_conversion_type'] = 'نوع التحويل غير معروف.'; $translation['copy_failed'] = 'خطأ في نسخ الملف على الخادم. copy() فشلت.'; $translation['reading_failed'] = 'خطأ في قراءة الملف.'; - diff --git a/src/lang/class.upload.tr_TR.php b/src/lang/class.upload.tr_TR.php index a27da0a..f042a09 100644 --- a/src/lang/class.upload.tr_TR.php +++ b/src/lang/class.upload.tr_TR.php @@ -1,4 +1,3 @@ - Date: Thu, 7 Dec 2023 00:03:32 +0100 Subject: [PATCH 3/4] Add a warning about security (CVE-2023-6551) --- README.md | 17 +++++++++++++++++ src/class.upload.php | 4 +++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 80c186b..d885eef 100644 --- a/README.md +++ b/README.md @@ -168,6 +168,23 @@ echo $handle->process(); die(); ``` +### Warning about security + +By default, the class relies on MIME type detection to assess whether the file can be uploaded or not. Several MIME type detection methods are used, depending on the server configuration. The class relies on a blacklist of dangerous file extensions to prevent uploads (or to rename dangerous scripts as text files), as well as a whitelist of accepted MIME types. + +But it is not the purpose of this class to do in-depth checking and heuristics to attempt to detect maliciously crafted files. For instance, an attacker can craft a file that will have the correct MIME type, but will carry a malicious payload, such as a valid GIF file which would contain some code leading to a XSS vulnerability. If this GIF file has a .html extension, it may be uploaded (depending on the class's settings) and display an XSS vulnerability. + +However, you can mitigate this by restricting the kind of files that can be uploaded, using `allowed` and `forbidden`, to whitelist and blacklist files depending on their MIME type or extension. *The most secure option would be to only whitelist extensions that you want to allow through, and then making sure that your server always serves the file with the content-type based on the file extension.* + +For instance, if you only want to allow one type of file, you could whitelist only its file extension. In the following example, only .html files are let through, and are not converted to a text file: +```php +$handle->allowed = array('html'); +$handle->forbidden = array(); +$handle->no_script = false; +``` + +In the end, it is your responsibility to make sure the correct files are uploaded. But more importantly, it is your responsibility to serve the uploaded files correctly, for instance by forcing the server to always provide the content-type based on the file extension. + ### Troubleshooting diff --git a/src/class.upload.php b/src/class.upload.php index 40d9c28..ffc6193 100755 --- a/src/class.upload.php +++ b/src/class.upload.php @@ -1892,6 +1892,8 @@ function init() { 'bat', 'phar', 'wsdl', + 'html', + 'htm', ); $this->forbidden = array_merge($this->dangerous, array( @@ -2118,7 +2120,7 @@ function __construct($file, $lang = 'en_GB') { */ function upload($file, $lang = 'en_GB') { - $this->version = '17/11/2023'; + $this->version = '07/12/2023'; $this->file_src_name = ''; $this->file_src_name_body = ''; From 95414a649727929c3fd11582f663b12b48407a7c Mon Sep 17 00:00:00 2001 From: Colin Verot Date: Tue, 10 Sep 2024 21:03:59 +0200 Subject: [PATCH 4/4] fix vulnerable file extension check --- src/class.upload.php | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/class.upload.php b/src/class.upload.php index ffc6193..5a32c54 100755 --- a/src/class.upload.php +++ b/src/class.upload.php @@ -408,7 +408,7 @@ class Upload { * The list of blacklisted extensions is in {@link dangerous} * * Note that this check happens before checking for forbidden MIME types or extensions - * If you want to forbid uploads rather than turning scripts into text files, + * If you want to forbid uploads rather than turning scripts into text files, * set {@link no_script} to false and use {@link forbidden} instead * * @access public @@ -1895,12 +1895,12 @@ function init() { 'html', 'htm', ); - + $this->forbidden = array_merge($this->dangerous, array( 'exe', 'dll', )); - + $this->allowed = array( 'application/arj', 'application/excel', @@ -2120,7 +2120,7 @@ function __construct($file, $lang = 'en_GB') { */ function upload($file, $lang = 'en_GB') { - $this->version = '07/12/2023'; + $this->version = '10/09/2024'; $this->file_src_name = ''; $this->file_src_name_body = ''; @@ -3153,7 +3153,7 @@ function process($server_path = null) { } // if the file is text based, or has a dangerous extension, we rename it as .txt if ((((substr($this->file_src_mime, 0, 5) == 'text/' && $this->file_src_mime != 'text/rtf') || strpos($this->file_src_mime, 'javascript') !== false) && (substr($file_src_name, -4) != '.txt')) - || preg_match('/\.(' . implode('|', $this->dangerous) . ')$/i', $this->file_src_name) + || preg_match('/\.(' . implode('|', $this->dangerous) . ')/i', $this->file_src_name) || $this->file_force_extension && empty($file_src_name_ext)) { $this->file_src_mime = 'text/plain'; if ($this->file_src_name_ext) $file_src_name_body = $file_src_name_body . '.' . $this->file_src_name_ext; @@ -3175,7 +3175,7 @@ function process($server_path = null) { if (strpos($v, '/') == false) { if ($v == '*' || strtolower($v) == strtolower($file_src_name_ext)) { $allowed = true; - break; + break; } } else { list($v1, $v2) = explode('/', $v); @@ -3193,7 +3193,7 @@ function process($server_path = null) { if ($v == '*' || strtolower($v) == strtolower($file_src_name_ext)) { $allowed = false; $this->log .= '- extension ' . $v . ' is forbidden !
'; - break; + break; } } else { list($v1, $v2) = explode('/', $v);