Use a restricted permission for specifying binary paths

Created on 21 May 2025, 16 days ago

Problem/Motivation

Users with the "administer image optimize pipelines" permission can specify arbitrary paths to binaries, that can later be triggered to execute on demand when an image variant is requested. This permission is not marked as restricted, but allowing an unprivileged user to run arbitrary binaries on the filesystem could be unexpected and dangerous in some cases.

This project is not covered by the Drupal security team, discussed with @mcdruid and we agreed to open this issue in the public queue.

Steps to reproduce

Proposed resolution

Mark "administer image optimize pipelines" as restricted or add a new restricted permission for configuring binary paths.

Remaining tasks

User interface changes

API changes

Data model changes

📌 Task
Status

Active

Version

1.0

Component

Code

Created by

🇬🇧United Kingdom longwave UK

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @longwave
  • 🇬🇧United Kingdom steven jones

    Yeah, totally agree.

  • 🇬🇧United Kingdom mcdruid 🇬🇧🇪🇺

    Perhaps the module could also do a stable release and opt in to security coverage :)

    Thanks for the very quick response @steven jones

  • 🇬🇧United Kingdom steven jones

    @mcdruid so in all honesty I've not opt-ed in because I suspect that there are these sorts of security issues kicking around in this (sub-)module, obviously lets fix this issue but I probably need to get a decent security review of this module done, and then opt-in, otherwise it's going to be lots of issues being managed in private I suspect, which is bad for getting them right / being able to use the drupal.org tools etc.

    I wonder if there are subtle security risks like placing a script in a location that this module is going to try to call, but doing something weird when the webserver calls it. Hmm...I feel like the security boundary needs tightly definining etc. otherwise it's going to be a nightmare!

Production build 0.71.5 2024