mapserver/mapserver — pull request #4703 by tbonfort (2013-07-27 09:47:48+00:00)
Title: Denials of service with SLD parameter in WMS requests

I've identified several flows in the handling of the SLD parameter of WMS GetFeature requests :

* you can pass SLD=file:///some/path/on/file/system. This will read the local file, but as the curl return code is 0 and not 200, the download will be considered as failed. I don't think that a remote attacker could get back that content, but it can lead to big local files being read and stored in the temporary file : 30 second timeout * 40 MB/sec = 1.2 GB

--> We could check in msHTTPGetFile() that the URL starts with http:// or https://

* a valid HTTP URL could also lead to a big file being read. The 30 second timeout can be sufficient for large files being transfered if you have a connexion with large bandwith. This could also potentially lead to huge memory allocation (let's say that the path is a path to a huge raster file) in msSLDApplySLDURL() when it ingests the file.

--> Could be mitigated by making sure that msHTTPWriteFct (in the case of dowloading a SLD or an external graphic from msSLDParseExternalGraphic()) stops after downloading, let's say 1 MB, 10 MB ?

* msSLDApplySLDURL() doesn't unlink the temporary file in case of failure, which leads to accumulation of potentially big files --> can be easily fixed

* Even a 1 MB SLD can be large enough to make the CPU of a MapServer instance busy for a few thousand years.

For example:
```xml

bla
bla
[ repeated 10000 times ]
bla

```

Breaking in the debugger shows that the time is spent in msGetLayerIndex(). Indeed, the issue is in msSLDApplySLD() that has :

```c
for (m=0; m Could be mitigated by validating that the SLD URL doesn't contain % and ? characters ? And that it has a .xml or .sld extension ?

Of course all of this can be avoided by defining "ows_sld_enabled" "false" in the mapfile, but as true is the default value, many servers are potentially vulnerable. The documentation doesn't really warns the user about the implications of enabling SLD. Perhaps should the default value be changed to "false" for 6.4 or 7.0 ?