Changeset 3269:da4849c1ad84

Timestamp:

07/17/16 10:09:33 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

default

Message:

Prevents SSRF/XSPA on Feed import, thanks wiswat for reporting this.

Files:

• inc/core/class.dc.core.php (modified) (1 diff)
• inc/dbschema/upgrade.php (modified) (1 diff)
• plugins/importExport/inc/class.dc.import.feed.php (modified) (2 diffs)

inc/core/class.dc.core.php

@@ -1455 +1455 @@
                     'Include sub-categories in category page and category posts feed'),
                     array('wiki_comments','boolean',false,
-                    'Allow commenters to use a subset of wiki syntax')
+                    'Allow commenters to use a subset of wiki syntax'),
+                    array('import_feed_url_control','boolean',true,
+                    'Control feed URL before import'),
+                    array('import_feed_no_private_ip','boolean',true,
+                    'Prevent import feed from private IP'),
+                    array('import_feed_ip_regexp','string','',
+                    'Authorize import feed only from this IP regexp'),
+                    array('import_feed_port_regexp','string','/^(80|443)$/',
+                    'Authorize import feed only from this port regexp')
                );
           }

inc/dbschema/upgrade.php

@@ -563 +563 @@
                          "    OR setting_value = '/\\.(phps?|pht(ml)?|phl|s?html?|js)[0-9]*\$/i'";
                $core->con->execute($strReq);
+
+               # Some new settings should be initialized, prepare db queries
+               $strReq = 'INSERT INTO '.$core->prefix.'setting'.
+                         ' (setting_id,setting_ns,setting_value,setting_type,setting_label)'.
+                         ' VALUES(\'%s\',\'system\',\'%s\',\'%s\',\'%s\')';
+               $core->con->execute(
+                    sprintf($strReq,'import_feed_url_control',true,'boolean','Control feed URL before import'));
+               $core->con->execute(
+                    sprintf($strReq,'import_feed_no_private_ip',true,'boolean','Prevent import feed from private IP'));
+               $core->con->execute(
+                    sprintf($strReq,'import_feed_ip_regexp','','string','Authorize import feed only from this IP regexp'));
+               $core->con->execute(
+                    sprintf($strReq,'import_feed_port_regexp','/^(80|443)$/','string','Authorize import feed only from this port regexp'));
           }
 

plugins/importExport/inc/class.dc.import.feed.php

@@ -16 +16 @@
      protected $status = false;
      protected $feed_url = '';
+
+     // IPv6 functions (from https://gist.github.com/tbaschak/7866688)
+     private function gethostbyname6($host,$try_a = false) {
+        // get AAAA record for $host
+        // if $try_a is true, if AAAA fails, it tries for A
+        // the first match found is returned
+        // otherwise returns false
+
+        $dns = $this->gethostbynamel6($host,$try_a);
+        if ($dns == false) {
+          return false;
+        }
+        else {
+          return $dns[0];
+        }
+    }
+    private function gethostbynamel6($host,$try_a = false) {
+        // get AAAA records for $host,
+        // if $try_a is true, if AAAA fails, it tries for A
+        // results are returned in an array of ips found matching type
+        // otherwise returns false
+
+        $dns6 = dns_get_record($host,DNS_AAAA);
+        if ($try_a == true) {
+            $dns4 = dns_get_record($host,DNS_A);
+            $dns = array_merge($dns4,$dns6);
+        }
+        else {
+          $dns = $dns6;
+        }
+        $ip6 = array();
+        $ip4 = array();
+        foreach ($dns as $record) {
+            if ($record["type"] == "A") {
+                $ip4[] = $record["ip"];
+            }
+            if ($record["type"] == "AAAA") {
+                $ip6[] = $record["ipv6"];
+            }
+        }
+        if (count($ip6) < 1) {
+            if ($try_a == true) {
+                if (count($ip4) < 1) {
+                    return false;
+                }
+                else {
+                    return $ip4;
+                }
+            }
+            else {
+                return false;
+            }
+        }
+        else {
+            return $ip6;
+        }
+    }
 
      public function setInfo()
@@ -36 +93 @@
 
           $this->feed_url = $_POST['feed_url'];
+
+          // Check feed URL
+          if ($this->core->blog->settings->system->import_feed_url_control) {
+               // Get IP from URL
+               $bits = parse_url($this->feed_url);
+               if (!$bits || !isset($bits['host'])) {
+                    throw new Exception(__('Cannot retrieve feed URL.'));
+               }
+               $ip = gethostbyname($bits['host']);
+               if ($ip == $bits['host']) {
+                    $ip = $this->gethostbyname6($bits['host']);
+                    if (!$ip) {
+                         throw new Exception(__('Cannot retrieve feed URL.'));
+                    }
+               }
+               // Check feed IP
+               $flag = FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6;
+               if ($this->core->blog->settings->system->import_feed_no_private_ip) {
+                    $flag |= FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE;
+               }
+               if (!filter_var($ip,$flag)) {
+                    throw new Exception(__('Cannot retrieve feed URL.'));
+               }
+               // IP control (white list regexp)
+               if ($this->core->blog->settings->system->import_feed_ip_regexp != '') {
+                    if (!preg_match($this->core->blog->settings->system->import_feed_ip_regexp,$ip)) {
+                         throw new Exception(__('Cannot retrieve feed URL.'));
+                    }
+               }
+               // Port control (white list regexp)
+               if ($this->core->blog->settings->system->import_feed_port_regexp != '' && isset($bits['port'])) {
+                    if (!preg_match($this->core->blog->settings->system->import_feed_port_regexp,$bits['port'])) {
+                         throw new Exception(__('Cannot retrieve feed URL.'));
+                    }
+               }
+          }
 
           $feed = feedReader::quickParse($this->feed_url);