Asset controller should validate filename prefix

Created on 26 June 2023, 12 months ago

Problem/Motivation

Reported by @Chi to the security team, but decided by me and @larowlan that it should be fine to fix in public as a critical bug.

Steps to reproduce

The asset aggregate controller validates URLs to prevent invalid ones from generating assets and/or writing to disk, however it doesn't valid the filename prefix (js_ or css_, this allows otherwise valid URLs to write to disk and potentially could be used for a disk-filling attack.

Proposed resolution

Validate the prefixes too.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

πŸ› Bug report
Status

Fixed

Version

10.1 ✨

Component
Asset libraryΒ  β†’

Last updated 2 days ago

No maintainer
Created by

πŸ‡¬πŸ‡§United Kingdom catch

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024