Skip to content

Commit 4a43846

Browse files
AltahrimAltahrim
committed
feat(previews): add file signature check before opening files
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
1 parent d4aacd8 commit 4a43846

11 files changed

Lines changed: 200 additions & 6 deletions

File tree

‎lib/private/Preview/Bitmap.php‎

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,25 @@
3838
*/
3939
abstract class Bitmap extends ProviderV2 {
4040

41+
/**
42+
* List of MIME types that this preview provider is allowed to process.
43+
*
44+
* These should correspond to the MIME types *identified* by Imagemagick
45+
* for files to be processed by this provider. These do / will not
46+
* necessarily need to match the MIME types stored in the database
47+
* (which are identified by IMimeTypeDetector).
48+
*
49+
* @return string Regular expression
50+
*/
51+
abstract protected function getAllowedMimeTypes(): string;
52+
53+
/**
54+
* @return list<string>
55+
*/
56+
abstract protected function getMagicStrings(): array;
57+
58+
abstract protected function getImagickFormatHint(): string;
59+
4160
/**
4261
* {@inheritDoc}
4362
*/
@@ -78,12 +97,25 @@ public function getThumbnail(File $file, int $maxX, int $maxY): ?IImage {
7897
* @param int $maxY
7998
*
8099
* @return \Imagick
100+
*
101+
* @throws \Exception
81102
*/
82103
private function getResizedPreview($tmpPath, $maxX, $maxY) {
83104
$bp = new Imagick();
84105

106+
if (!$this->isMagicStringSupported($tmpPath)) {
107+
throw new \Exception('Invalid image type: magic string not recognized');
108+
}
109+
110+
// Validate mime type
111+
$bp->pingImage($this->getImagickFormatHint() . ':' . $tmpPath . '[0]');
112+
$mimeType = $bp->getImageMimeType();
113+
if (!preg_match($this->getAllowedMimeTypes(), $mimeType)) {
114+
throw new \Exception('File mime type does not match the preview provider: ' . $mimeType);
115+
}
116+
85117
// Layer 0 contains either the bitmap or a flat representation of all vector layers
86-
$bp->readImage($tmpPath . '[0]');
118+
$bp->readImage($this->getImagickFormatHint() . ':' . $tmpPath . '[0]');
87119

88120
$bp = $this->resize($bp, $maxX, $maxY);
89121

@@ -92,6 +124,24 @@ private function getResizedPreview($tmpPath, $maxX, $maxY) {
92124
return $bp;
93125
}
94126

127+
private function isMagicStringSupported(string $filepath): bool {
128+
$signatures = $this->getMagicStrings();
129+
if (empty($signatures)) {
130+
return true;
131+
}
132+
$length = array_reduce($signatures, static function (int $carry, string $signature) {
133+
return max($carry, strlen($signature));
134+
}, 0);
135+
$firstBytes = file_get_contents($filepath, false, null, 0, $length);
136+
foreach ($signatures as $signature) {
137+
if (str_starts_with($firstBytes, $signature)) {
138+
return true;
139+
}
140+
}
141+
142+
return false;
143+
}
144+
95145
/**
96146
* Returns a resized \Imagick object
97147
*

‎lib/private/Preview/Font.php‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,22 @@ class Font extends Bitmap {
3030
public function getMimeType(): string {
3131
return '/application\/(?:font-sfnt|x-font$)/';
3232
}
33+
34+
/**
35+
* {@inheritDoc}
36+
*/
37+
protected function getAllowedMimeTypes(): string {
38+
return '/(application|image)\/(?:font-sfnt|x-font|x-otf|x-ttf|x-pfb$)/';
39+
}
40+
41+
protected function getMagicStrings(): array {
42+
return [
43+
"\x00\x01\x00\x00\x00", // TTF
44+
'OTTO', // OTF
45+
];
46+
}
47+
48+
protected function getImagickFormatHint(): string {
49+
return 'ttf';
50+
}
3351
}

‎lib/private/Preview/HEIC.php‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
namespace OC\Preview;
3131

3232
use OCP\Files\File;
33+
use OCP\Files\FileInfo;
3334
use OCP\IImage;
3435
use OCP\ILogger;
3536

@@ -43,20 +44,24 @@ class HEIC extends ProviderV2 {
4344
* {@inheritDoc}
4445
*/
4546
public function getMimeType(): string {
46-
return '/image\/hei(f|c)/';
47+
return '/image\/(x-)?hei(f|c)/';
4748
}
4849

4950
/**
5051
* {@inheritDoc}
5152
*/
52-
public function isAvailable(\OCP\Files\FileInfo $file): bool {
53+
public function isAvailable(FileInfo $file): bool {
5354
return in_array('HEIC', \Imagick::queryFormats("HEI*"));
5455
}
5556

5657
/**
5758
* {@inheritDoc}
5859
*/
5960
public function getThumbnail(File $file, int $maxX, int $maxY): ?IImage {
61+
if (!$this->isAvailable($file)) {
62+
return null;
63+
}
64+
6065
$tmpPath = $this->getLocalFile($file);
6166

6267
// Creates \Imagick object from the heic file
@@ -94,12 +99,22 @@ public function getThumbnail(File $file, int $maxX, int $maxY): ?IImage {
9499
* @param int $maxY
95100
*
96101
* @return \Imagick
102+
*
103+
* @throws \Exception
97104
*/
98105
private function getResizedPreview($tmpPath, $maxX, $maxY) {
99106
$bp = new \Imagick();
100107

108+
// Some HEIC files just contain (or at least are identified as) other formats
109+
// like JPEG. We just need to check if the image is safe to process.
110+
$bp->pingImage('heic:' . $tmpPath . '[0]');
111+
$mimeType = $bp->getImageMimeType();
112+
if (!preg_match('/^image\/(x-)?(png|jpeg|gif|bmp|tiff|webp|hei(f|c)|avif)$/', $mimeType)) {
113+
throw new \Exception('File mime type does not match the preview provider: ' . $mimeType);
114+
}
115+
101116
// Layer 0 contains either the bitmap or a flat representation of all vector layers
102-
$bp->readImage($tmpPath . '[0]');
117+
$bp->readImage('heic:' . $tmpPath . '[0]');
103118

104119
$bp->setImageFormat('jpg');
105120

‎lib/private/Preview/Illustrator.php‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,19 @@ class Illustrator extends Bitmap {
3131
public function getMimeType(): string {
3232
return '/application\/illustrator/';
3333
}
34+
35+
/**
36+
* {@inheritDoc}
37+
*/
38+
protected function getAllowedMimeTypes(): string {
39+
return '/application\/(illustrator|pdf)/';
40+
}
41+
42+
protected function getMagicStrings(): array {
43+
return ["\x25\x50\x44\x46"];
44+
}
45+
46+
protected function getImagickFormatHint(): string {
47+
return 'ai';
48+
}
3449
}

‎lib/private/Preview/PDF.php‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,19 @@ class PDF extends Bitmap {
3131
public function getMimeType(): string {
3232
return '/application\/pdf/';
3333
}
34+
35+
/**
36+
* {@inheritDoc}
37+
*/
38+
protected function getAllowedMimeTypes(): string {
39+
return '/application\/pdf/';
40+
}
41+
42+
protected function getMagicStrings(): array {
43+
return ['%PDF-'];
44+
}
45+
46+
protected function getImagickFormatHint(): string {
47+
return 'pdf';
48+
}
3449
}

‎lib/private/Preview/Photoshop.php‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,19 @@ class Photoshop extends Bitmap {
3131
public function getMimeType(): string {
3232
return '/application\/x-photoshop/';
3333
}
34+
35+
/**
36+
* {@inheritDoc}
37+
*/
38+
protected function getAllowedMimeTypes(): string {
39+
return '/(application|image)\/(x-photoshop|x-psd)/';
40+
}
41+
42+
protected function getMagicStrings(): array {
43+
return ['8BPS'];
44+
}
45+
46+
protected function getImagickFormatHint(): string {
47+
return 'psd';
48+
}
3449
}

‎lib/private/Preview/Postscript.php‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,19 @@ class Postscript extends Bitmap {
3131
public function getMimeType(): string {
3232
return '/application\/postscript/';
3333
}
34+
35+
/**
36+
* {@inheritDoc}
37+
*/
38+
protected function getAllowedMimeTypes(): string {
39+
return '/application\/postscript/';
40+
}
41+
42+
protected function getMagicStrings(): array {
43+
return ['%!PS'];
44+
}
45+
46+
protected function getImagickFormatHint(): string {
47+
return 'ps';
48+
}
3449
}

‎lib/private/Preview/ProviderV2.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
abstract class ProviderV2 implements IProviderV2 {
3434
private $options;
3535

36+
/** @var array */
3637
private $tmpFiles = [];
3738

3839
/**

‎lib/private/Preview/SGI.php‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,21 @@ class SGI extends Bitmap {
2828
* {@inheritDoc}
2929
*/
3030
public function getMimeType(): string {
31-
return '/image\/sgi/';
31+
return '/image\/(x-)?sgi/';
32+
}
33+
34+
/**
35+
* {@inheritDoc}
36+
*/
37+
protected function getAllowedMimeTypes(): string {
38+
return '/image\/(x-)?sgi/';
39+
}
40+
41+
protected function getMagicStrings(): array {
42+
return ["\x01\xDA"];
43+
}
44+
45+
protected function getImagickFormatHint(): string {
46+
return 'sgi';
3247
}
3348
}

‎lib/private/Preview/TGA.php‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,21 @@ class TGA extends Bitmap {
2828
* {@inheritDoc}
2929
*/
3030
public function getMimeType(): string {
31-
return '/image\/t(ar)?ga/';
31+
return '/image\/(x-)?t(ar)?ga/';
32+
}
33+
34+
/**
35+
* {@inheritDoc}
36+
*/
37+
protected function getAllowedMimeTypes(): string {
38+
return '/image\/(x-)?t(ar)?ga/';
39+
}
40+
41+
protected function getMagicStrings(): array {
42+
return [];
43+
}
44+
45+
protected function getImagickFormatHint(): string {
46+
return 'tga';
3247
}
3348
}

0 commit comments

Comments
 (0)