open-dsi
/
nextcloud-server
mirror of https://github.com/nextcloud/server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #8260 from owncloud/stable6-backport-8183-and-co

Browse Source 
Backport of #8183 and #8197
remotes/origin/stable6
Thomas Müller 12 years ago
parent a314508543 9b36224bd4
commit 1041617a4e
8 changed files with 197 additions and 114 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 29
      lib/base.php
  2. 7
      lib/private/connector/sabre/file.php
  3. 36
      lib/private/files/type/detection.php
  4. 10
      lib/private/helper.php
  5. 2
      lib/private/json.php
  6. 192
      lib/private/mimetypes.list.php
  7. 23
      lib/private/template.php
  8. 12
      tests/lib/helper.php

29
lib/base.php
Unescape View File

@ -206,6 +206,34 @@ class OC {
}
}
/*
* This function adds some security related headers to all requests served via base.php
* The implementation of this function has to happen here to ensure that all third-party
* components (e.g. SabreDAV) also benefit from this headers.
*/
public static function addSecurityHeaders() {
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
// iFrame Restriction Policy
$xFramePolicy = OC_Config::getValue('xframe_restriction', true);
if($xFramePolicy) {
header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains
}
// Content Security Policy
// If you change the standard policy, please also change it in config.sample.php
$policy = OC_Config::getValue('custom_csp_policy',
'default-src \'self\'; '
.'script-src \'self\' \'unsafe-eval\'; '
.'style-src \'self\' \'unsafe-inline\'; '
.'frame-src *; '
.'img-src *; '
.'font-src \'self\' data:; '
.'media-src *');
header('Content-Security-Policy:'.$policy);
}
public static function checkSSL() {
// redirect to https site if configured
if (OC_Config::getValue("forcessl", false)) {
@ -516,6 +544,7 @@ class OC {
self::checkConfig();
self::checkInstalled();
self::checkSSL();
self::addSecurityHeaders();
$errors = OC_Util::checkServer();
if (count($errors) > 0) {

7
lib/private/connector/sabre/file.php
Unescape View File

@ -199,11 +199,12 @@ class OC_Connector_Sabre_File extends OC_Connector_Sabre_Node implements Sabre_D
*/
public function getContentType() {
if (isset($this->fileinfo_cache['mimetype'])) {
return $this->fileinfo_cache['mimetype'];
$mimeType = $this->fileinfo_cache['mimetype'];
} else {
$mimeType = \OC\Files\Filesystem::getMimeType($this->path);
}
return \OC\Files\Filesystem::getMimeType($this->path);
return \OC_Helper::getSecureMimeType($mimeType);
}
private function createFileChunked($data)

36
lib/private/files/type/detection.php
Unescape View File

@ -17,15 +17,22 @@ namespace OC\Files\Type;
*/
class Detection {
protected $mimetypes = array();
protected $secureMimeTypes = array();
/**
* add an extension -> mimetype mapping
* Add an extension -> mimetype mapping
*
* $mimetype is the assumed correct mime type
* The optional $secureMimeType is an alternative to send to send
* to avoid potential XSS.
*
* @param string $extension
* @param string $mimetype
* @param string|null $secureMimeType
*/
public function registerType($extension, $mimetype) {
$this->mimetypes[$extension] = $mimetype;
public function registerType($extension, $mimetype, $secureMimeType = null) {
$this->mimetypes[$extension] = array($mimetype, $secureMimeType);
$this->secureMimeTypes[$mimetype] = $secureMimeType ?: $mimetype;
}
/**
@ -35,6 +42,11 @@ class Detection {
*/
public function registerTypeArray($types) {
$this->mimetypes = array_merge($this->mimetypes, $types);
// Update the alternative mimetypes to avoid having to look them up each time.
foreach ($this->mimetypes as $mimeType) {
$this->secureMimeTypes[$mimeType[0]] = $mimeType[1] ?: $mimeType[0];
}
}
/**
@ -48,8 +60,10 @@ class Detection {
//try to guess the type by the file extension
$extension = strtolower(strrchr(basename($path), "."));
$extension = substr($extension, 1); //remove leading .
return (isset($this->mimetypes[$extension])) ? $this->mimetypes[$extension] : 'application/octet-stream';
} else {
return (isset($this->mimetypes[$extension]) && isset($this->mimetypes[$extension][0]))
? $this->mimetypes[$extension][0]
: 'application/octet-stream';
} else {
return 'application/octet-stream';
}
}
@ -122,4 +136,16 @@ class Detection {
return $mime;
}
}
/**
* Get a secure mimetype that won't expose potential XSS.
*
* @param string $mimeType
* @return string
*/
public function getSecureMimeType($mimeType) {
return isset($this->secureMimeTypes[$mimeType])
? $this->secureMimeTypes[$mimeType]
: 'application/octet-stream';
}
}

10
lib/private/helper.php
Unescape View File

@ -398,6 +398,16 @@ class OC_Helper {
return self::getMimetypeDetector()->detect($path);
}
/**
* Get a secure mimetype that won't expose potential XSS.
*
* @param string $mimeType
* @return string
*/
static function getSecureMimeType($mimeType) {
return self::getMimetypeDetector()->getSecureMimeType($mimeType);
}
/**
* get the mimetype form a data string
*

2
lib/private/json.php
Unescape View File

@ -118,8 +118,6 @@ class OC_JSON{
* Encode and print $data in json format
*/
public static function encodedPrint($data, $setContentType=true) {
// Disable mimesniffing, don't move this to setContentTypeHeader!
header( 'X-Content-Type-Options: nosniff' );
if($setContentType) {
self::setContentTypeHeader();
}

192
lib/private/mimetypes.list.php
Unescape View File

@ -21,86 +21,116 @@
*/
/**
* list of mimetypes by extension
* Array mapping file extensions to mimetypes (in alphabetical order).
*
* The first index in the mime type array is the assumed correct mimetype
* and the second is either a secure alternative or null if the correct
* is considered secure.
*/
return array(
'css'=>'text/css',
'flac'=>'audio/flac',
'gif'=>'image/gif',
'gzip'=>'application/x-gzip',
'gz'=>'application/x-gzip',
'html'=>'text/html',
'htm'=>'text/html',
'ics'=>'text/calendar',
'ical'=>'text/calendar',
'jpeg'=>'image/jpeg',
'jpg'=>'image/jpeg',
'js'=>'application/javascript',
'oga'=>'audio/ogg',
'ogg'=>'audio/ogg',
'ogv'=>'video/ogg',
'pdf'=>'application/pdf',
'png'=>'image/png',
'svg'=>'image/svg+xml',
'tar'=>'application/x-tar',
'tgz'=>'application/x-compressed',
'tar.gz'=>'application/x-compressed',
'tif'=>'image/tiff',
'tiff'=>'image/tiff',
'txt'=>'text/plain',
'zip'=>'application/zip',
'wav'=>'audio/wav',
'odt'=>'application/vnd.oasis.opendocument.text',
'ods'=>'application/vnd.oasis.opendocument.spreadsheet',
'odg'=>'application/vnd.oasis.opendocument.graphics',
'odp'=>'application/vnd.oasis.opendocument.presentation',
'pages'=>'application/x-iwork-pages-sffpages',
'numbers'=>'application/x-iwork-numbers-sffnumbers',
'keynote'=>'application/x-iwork-keynote-sffkey',
'kra'=>'application/x-krita',
'mp3'=>'audio/mpeg',
'doc'=>'application/msword',
'docx'=>'application/msword',
'xls'=>'application/msexcel',
'xlsx'=>'application/msexcel',
'php'=>'application/x-php',
'exe'=>'application/x-ms-dos-executable',
'msi'=>'application/x-msi',
'pl'=>'application/x-pearl',
'py'=>'application/x-python',
'blend'=>'application/x-blender',
'xcf'=>'application/x-gimp',
'psd'=>'application/x-photoshop',
'xml'=>'application/xml',
'avi'=>'video/x-msvideo',
'dv'=>'video/dv',
'm2t'=>'video/mp2t',
'mp4'=>'video/mp4',
'm4v'=>'video/mp4',
'mpg'=>'video/mpeg',
'mpeg'=>'video/mpeg',
'mov'=>'video/quicktime',
'webm'=>'video/webm',
'wmv'=>'video/x-ms-asf',
'py'=>'text/x-script.phyton',
'vcf' => 'text/vcard',
'vcard' => 'text/vcard',
'doc'=>'application/msword',
'docx'=>'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
'xls'=>'application/msexcel',
'xlsx'=>'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
'ppt'=>'application/mspowerpoint',
'pptx'=>'application/vnd.openxmlformats-officedocument.presentationml.presentation',
'sgf' => 'application/sgf',
'cdr' => 'application/coreldraw',
'impress' => 'text/impress',
'ai' => 'application/illustrator',
'epub' => 'application/epub+zip',
'mobi' => 'application/x-mobipocket-ebook',
'md' => 'text/markdown',
'markdown' => 'text/markdown',
'mdown' => 'text/markdown',
'mdwn' => 'text/markdown',
'reveal' => 'text/reveal'
);
'7z' => array('application/x-7z-compressed', null),
'accdb' => array('application/msaccess', null),
'ai' => array('application/illustrator', null),
'avi' => array('video/x-msvideo', null),
'bash' => array('text/x-shellscript', null),
'blend' => array('application/x-blender', null),
'bin' => array('application/x-bin', null),
'bmp' => array('image/bmp', null),
'cb7' => array('application/x-cbr', null),
'cba' => array('application/x-cbr', null),
'cbr' => array('application/x-cbr', null),
'cbt' => array('application/x-cbr', null),
'cbtc' => array('application/x-cbr', null),
'cbz' => array('application/x-cbr', null),
'cc' => array('text/x-c', null),
'cdr' => array('application/coreldraw', null),
'cpp' => array('text/x-c++src', null),
'css' => array('text/css', null),
'csv' => array('text/csv', null),
'cvbdl' => array('application/x-cbr', null),
'c' => array('text/x-c', null),
'c++' => array('text/x-c++src', null),
'deb' => array('application/x-deb', null),
'doc' => array('application/msword', null),
'docx' => array('application/vnd.openxmlformats-officedocument.wordprocessingml.document', null),
'dot' => array('application/msword', null),
'dotx' => array('application/vnd.openxmlformats-officedocument.wordprocessingml.template', null),
'dv' => array('video/dv', null),
'eot' => array('application/vnd.ms-fontobject', null),
'epub' => array('application/epub+zip', null),
'exe' => array('application/x-ms-dos-executable', null),
'flac' => array('audio/flac', null),
'gif' => array('image/gif', null),
'gz' => array('application/x-gzip', null),
'gzip' => array('application/x-gzip', null),
'html' => array('text/html', 'text/plain'),
'htm' => array('text/html', 'text/plain'),
'ical' => array('text/calendar', null),
'ics' => array('text/calendar', null),
'impress' => array('text/impress', null),
'jpeg' => array('image/jpeg', null),
'jpg' => array('image/jpeg', null),
'js' => array('application/javascript', 'text/plain'),
'json' => array('application/json', 'text/plain'),
'keynote' => array('application/x-iwork-keynote-sffkey', null),
'kra' => array('application/x-krita', null),
'm2t' => array('video/mp2t', null),
'm4v' => array('video/mp4', null),
'markdown' => array('text/markdown', null),
'mdown' => array('text/markdown', null),
'md' => array('text/markdown', null),
'mdb' => array('application/msaccess', null),
'mdwn' => array('text/markdown', null),
'mkv' => array('video/x-matroska', null),
'mobi' => array('application/x-mobipocket-ebook', null),
'mov' => array('video/quicktime', null),
'mp3' => array('audio/mpeg', null),
'mp4' => array('video/mp4', null),
'mpeg' => array('video/mpeg', null),
'mpg' => array('video/mpeg', null),
'msi' => array('application/x-msi', null),
'numbers' => array('application/x-iwork-numbers-sffnumbers', null),
'odg' => array('application/vnd.oasis.opendocument.graphics', null),
'odp' => array('application/vnd.oasis.opendocument.presentation', null),
'ods' => array('application/vnd.oasis.opendocument.spreadsheet', null),
'odt' => array('application/vnd.oasis.opendocument.text', null),
'oga' => array('audio/ogg', null),
'ogg' => array('audio/ogg', null),
'ogv' => array('video/ogg', null),
'otf' => array('font/opentype', null),
'pages' => array('application/x-iwork-pages-sffpages', null),
'pdf' => array('application/pdf', null),
'php' => array('application/x-php', null),
'pl' => array('application/x-perl', null),
'png' => array('image/png', null),
'ppt' => array('application/mspowerpoint', null),
'pptx' => array('application/vnd.openxmlformats-officedocument.presentationml.presentation', null),
'psd' => array('application/x-photoshop', null),
'py' => array('text/x-python', null),
'rar' => array('application/x-rar-compressed', null),
'reveal' => array('text/reveal', null),
'sgf' => array('application/sgf', null),
'sh-lib' => array('text/x-shellscript', null),
'sh' => array('text/x-shellscript', null),
'svg' => array('image/svg+xml', 'text/plain'),
'swf' => array('application/x-shockwave-flash', 'application/octet-stream'),
'tar' => array('application/x-tar', null),
'tar.gz' => array('application/x-compressed', null),
'tex' => array('application/x-tex', null),
'tgz' => array('application/x-compressed', null),
'tiff' => array('image/tiff', null),
'tif' => array('image/tiff', null),
'ttf' => array('application/x-font-ttf', null),
'txt' => array('text/plain', null),
'vcard' => array('text/vcard', null),
'vcf' => array('text/vcard', null),
'wav' => array('audio/wav', null),
'webm' => array('video/webm', null),
'woff' => array('application/font-woff', null),
'wmv' => array('video/x-ms-asf', null),
'xcf' => array('application/x-gimp', null),
'xls' => array('application/msexcel', null),
'xlsx' => array('application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', null),
'xml' => array('application/xml', 'text/plain'),
'zip' => array('application/zip', null),
);

23
lib/private/template.php
Unescape View File

@ -64,29 +64,6 @@ class OC_Template extends \OC\Template\Base {
$this->path = $path;
parent::__construct($template, $requesttoken, $l10n, $themeDefaults);
// Some headers to enhance security
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
// iFrame Restriction Policy
$xFramePolicy = OC_Config::getValue('xframe_restriction', true);
if($xFramePolicy) {
header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains
}
// Content Security Policy
// If you change the standard policy, please also change it in config.sample.php
$policy = OC_Config::getValue('custom_csp_policy',
'default-src \'self\'; '
.'script-src \'self\' \'unsafe-eval\'; '
.'style-src \'self\' \'unsafe-inline\'; '
.'frame-src *; '
.'img-src *; '
.'font-src \'self\' data:; '
.'media-src *');
header('Content-Security-Policy:'.$policy); // Standard
}
/**

12
tests/lib/helper.php
Unescape View File

@ -69,6 +69,18 @@ class Test_Helper extends PHPUnit_Framework_TestCase {
$this->assertEquals($result, $expected);
}
function testGetSecureMimeType() {
$dir=OC::$SERVERROOT.'/tests/data';
$result = OC_Helper::getSecureMimeType('image/svg+xml');
$expected = 'text/plain';
$this->assertEquals($result, $expected);
$result = OC_Helper::getSecureMimeType('image/png');
$expected = 'image/png';
$this->assertEquals($result, $expected);
}
function testGetFileNameMimeType() {
$this->assertEquals('text/plain', OC_Helper::getFileNameMimeType('foo.txt'));
$this->assertEquals('image/png', OC_Helper::getFileNameMimeType('foo.png'));

Write Preview
Loading…
Cancel
Save