fabi/PiCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(audit-2026-06-11/C-2): file download attachment + nosniff + CSP + MIME allowlist

Browse Source 
Stored XSS: the previous get_file handler streamed user-supplied bytes
with Content-Disposition: inline, the user-supplied Content-Type, and
no X-Content-Type-Options / CSP. A Rhai script could store an SVG or
HTML payload whose download URL rendered same-origin under the admin
session cookie.

Closes the response side and the storage side:

* shared::sanitize_stored_content_type: allowlist
  (octet-stream/pdf/json/text-plain/text-csv/image-non-svg/audio/video)
  with anything else coerced to application/octet-stream. New unit tests
  cover the safe/unsafe/case-insensitive/parameter-preserving paths.

* files_service::create/update: sanitize the stored content_type after
  the shape checks pass (sanitize-after-validate keeps the existing
  MissingField / TooLong errors intact). Two new tests confirm text/html
  and image/svg+xml are coerced to application/octet-stream on
  create/update respectively.

* files_api::get_file (admin download):
  - Content-Disposition: attachment (was inline)
  - Content-Type re-sanitized via the shared helper as belt-and-
    suspenders for any pre-existing row that pre-dates this change.
  - X-Content-Type-Options: nosniff
  - Content-Security-Policy: default-src 'none'; sandbox;
    frame-ancestors 'none'
  - Referrer-Policy: no-referrer

Audit ref: security_audit/07_http_cors_csrf_xss.md#c07-02 (response side)
+ security_audit/06_files_pathtraversal.md#f-fs-001 (storage side).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-11 20:24:55 +02:00
parent b096ea9c4e
commit fde4796479
4 changed files with 209 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
crates/manager-core/src/files_api.rs
View File

@@ -123,10 +123,20 @@ async fn list_files(
}
/// `GET /apps/{id}/files/{collection}/{file_id}` — stream the file's
/// bytes inline. The dashboard's Download button hits this; the audit
/// flagged the missing handler (callers were 405'ing). Metadata gives
/// the Content-Type + Content-Disposition; bytes come from
/// `FilesRepo::get` (which checksum-verifies on read).
/// bytes as a download. The dashboard's Download button hits this;
/// metadata is read via `FilesRepo::head`, bytes via `FilesRepo::get`
/// (which checksum-verifies on read).
///
/// Audit 2026-06-11 C-2 — response hardening. The previous handler
/// served `Content-Disposition: inline` with the user-supplied
/// `Content-Type` and no `nosniff` / CSP, so an SVG or HTML upload
/// rendered same-origin and hijacked the admin session. Now:
/// * `Content-Disposition: attachment` always.
/// * `Content-Type` re-sanitized to the storage allowlist as
/// belt-and-suspenders (`files_service::create` / `update` already
/// coerce at write, but older rows may pre-date that change).
/// * `X-Content-Type-Options: nosniff` blocks MIME-sniffing fallbacks.
/// * Restrictive CSP scopes any residual rendering attempt.
async fn get_file(
State(s): State<FilesAdminState>,
Extension(principal): Extension<Principal>,
@@ -150,16 +160,23 @@ async fn get_file(
.get(app_id, &collection, id)
.await?
.ok_or(FilesApiError::NotFound)?;
let safe_ct = picloud_shared::sanitize_stored_content_type(&meta.content_type);
let disposition = format!(
"inline; filename=\"{}\"",
"attachment; filename=\"{}\"",
meta.name.replace('"', "").replace(['\r', '\n'], "")
);
let len = bytes.len();
Ok(Response::builder()
.status(StatusCode::OK)
.header(CONTENT_TYPE, meta.content_type)
.header(CONTENT_TYPE, safe_ct)
.header(CONTENT_DISPOSITION, disposition)
.header(CONTENT_LENGTH, len)
.header("X-Content-Type-Options", "nosniff")
.header(
"Content-Security-Policy",
"default-src 'none'; sandbox; frame-ancestors 'none'",
)
.header("Referrer-Policy", "no-referrer")
.body(Body::from(bytes))
.expect("build files download response"))
}

77
crates/manager-core/src/files_service.rs
View File

@@ -17,8 +17,8 @@ use std::sync::Arc;
use async_trait::async_trait;
use picloud_shared::{
validate_files_collection, FileMeta, FileUpdate, FilesError, FilesListPage, FilesService,
NewFile, SdkCallCx, ServiceEvent, ServiceEventEmitter,
sanitize_stored_content_type, validate_files_collection, FileMeta, FileUpdate, FilesError,
FilesListPage, FilesService, NewFile, SdkCallCx, ServiceEvent, ServiceEventEmitter,
};
use uuid::Uuid;
@@ -124,11 +124,14 @@ impl FilesService for FilesServiceImpl {
&self,
cx: &SdkCallCx,
collection: &str,
new: NewFile,
mut new: NewFile,
) -> Result<Uuid, FilesError> {
validate_files_collection(collection)?;
self.check_write(cx).await?;
new.validate(self.max_file_size_bytes)?;
// Audit 2026-06-11 C-2 — coerce dangerous render types to
// application/octet-stream after the shape checks pass.
new.content_type = sanitize_stored_content_type(&new.content_type);
let meta = self.repo.create(cx.app_id, collection, new).await?;
self.emit(cx, "create", collection, &meta, None).await;
Ok(meta.id)
@@ -167,11 +170,15 @@ impl FilesService for FilesServiceImpl {
cx: &SdkCallCx,
collection: &str,
id: &str,
upd: FileUpdate,
mut upd: FileUpdate,
) -> Result<(), FilesError> {
validate_files_collection(collection)?;
self.check_write(cx).await?;
upd.validate(self.max_file_size_bytes)?;
// Audit 2026-06-11 C-2 — sanitize after the shape checks pass.
if let Some(ct) = upd.content_type.as_deref() {
upd.content_type = Some(sanitize_stored_content_type(ct));
}
let Some(uuid) = parse_id(id) else {
return Err(FilesError::NotFound);
};
@@ -479,6 +486,68 @@ mod tests {
}
}
#[tokio::test]
async fn dangerous_render_content_type_is_coerced_on_create() {
// Audit 2026-06-11 C-2 closure.
let files = svc();
let cx = anon_cx(AppId::new());
let id = files
.create(
&cx,
"c",
NewFile {
name: "evil.html".into(),
content_type: "text/html".into(),
data: b"<script>alert(1)</script>".to_vec(),
},
)
.await
.unwrap();
let meta = files
.head(&cx, "c", &id.to_string())
.await
.unwrap()
.unwrap();
assert_eq!(meta.content_type, "application/octet-stream");
}
#[tokio::test]
async fn dangerous_render_content_type_is_coerced_on_update() {
let files = svc();
let cx = anon_cx(AppId::new());
let id = files
.create(
&cx,
"c",
NewFile {
name: "a.bin".into(),
content_type: "application/octet-stream".into(),
data: b"x".to_vec(),
},
)
.await
.unwrap();
files
.update(
&cx,
"c",
&id.to_string(),
FileUpdate {
data: b"y".to_vec(),
name: None,
content_type: Some("image/svg+xml".into()),
},
)
.await
.unwrap();
let meta = files
.head(&cx, "c", &id.to_string())
.await
.unwrap()
.unwrap();
assert_eq!(meta.content_type, "application/octet-stream");
}
#[tokio::test]
async fn create_then_get_head_round_trips() {
let files = svc();