CVE-2022-0950 (published 2022-03-15T09:15Z)

Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/star7th/showdoc
commit_details: repo_url: https://github.com/star7th/showdoc
author: star7th
author_date: 2022-03-14 17:46:33+08:00
msg: file upload bug
repository: repo_url: https://github.com/star7th/showdoc
repo_name: star7th/showdoc
description: ShowDoc is a tool greatly applicable for an IT team to share documents online一个非常适合IT团队的在线API文档、技术文档工具
repo_language: JavaScript
owner: star7th
file_changes: filename: AttachmentController.class.php
change_type: ModificationType.MODIFY
diff: @@ -79,7 +79,9 @@ class AttachmentController extends BaseController {
            return false;
         }
 
-        if(D("Attachment")->isDangerFilename($_FILES['editormd-image-file']['name'])){
+        if(!D("Attachment")->isAllowedFilename($_FILES['editormd-image-file']['name'])){
+            $message = "不支持上传该文件类型。如有需要请联系网站管理员" ;
+            echo json_encode(array("message"=>$message,"success"=>0));
             return false;
         }
 
@@ -109,8 +111,8 @@ class AttachmentController extends BaseController {
            return false;
         }
 
-        if(D("Attachment")->isDangerFilename($uploadFile['name'])){
-            $this->sendError(10100,'不支持此文件类型');
+        if(!D("Attachment")->isAllowedFilename($uploadFile['name'])){
+            $this->sendError(10101,'不支持上传该文件类型。如有需要请联系网站管理员');
             return false;
         }
 

programming_language: PHP
filename: AttachmentModel.class.php
change_type: ModificationType.MODIFY
diff: @@ -57,7 +57,7 @@ class AttachmentModel extends BaseModel {
 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if($this->isDangerFilename($uploadFile['name'])){
+		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
 			return false;
 		}
 
@@ -288,6 +288,7 @@ class AttachmentModel extends BaseModel {
 	}
 
 	// 判断文件名是否包含危险的扩展名
+	// 准备弃用。因为一个个ban太麻烦了。准备改用白名单机制
 	public function isDangerFilename($filename){
 
 		$isDangerStr = function ($filename , $keyword){
@@ -319,6 +320,24 @@ class AttachmentModel extends BaseModel {
 		return false;
 	}
 
-
+	// 判断上传的文件扩展名是否处于白名单内
+	public function isAllowedFilename($filename){
+		$allow_array = array(
+			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
+			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
+			'.mov','.webmv','.m3u8a','.flac','.mkv',
+			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
+			'.pdf','.ofd','.swf','.epub','.xps',
+			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt',
+			'.ppt','.pptx','.xls','.xlsx','.txt','.md','.psd','.csv',
+			'.cer','.ppt','.pub','.properties','.json','.css',
+			) ;
+
+		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
+		if(in_array( $ext , $allow_array ) ){
+			return true ;
+		}
+		return false;
+	}
 
 }

programming_language: PHP