{"action":"created","issue":{"url":"https://api.github.com/repos/opencfp/opencfp/issues/196","labels_url":"https://api.github.com/repos/opencfp/opencfp/issues/196/labels{/name}","comments_url":"https://api.github.com/repos/opencfp/opencfp/issues/196/comments","events_url":"https://api.github.com/repos/opencfp/opencfp/issues/196/events","html_url":"https://github.com/opencfp/opencfp/pull/196","id":78237486,"number":196,"title":"Photo Upload Vulnerability","user":{"login":"mdwheele","id":2453394,"avatar_url":"https://avatars.githubusercontent.com/u/2453394?v=3","gravatar_id":"","url":"https://api.github.com/users/mdwheele","html_url":"https://github.com/mdwheele","followers_url":"https://api.github.com/users/mdwheele/followers","following_url":"https://api.github.com/users/mdwheele/following{/other_user}","gists_url":"https://api.github.com/users/mdwheele/gists{/gist_id}","starred_url":"https://api.github.com/users/mdwheele/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdwheele/subscriptions","organizations_url":"https://api.github.com/users/mdwheele/orgs","repos_url":"https://api.github.com/users/mdwheele/repos","events_url":"https://api.github.com/users/mdwheele/events{/privacy}","received_events_url":"https://api.github.com/users/mdwheele/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-19T20:22:38Z","updated_at":"2015-05-19T20:24:22Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/opencfp/opencfp/pulls/196","html_url":"https://github.com/opencfp/opencfp/pull/196","diff_url":"https://github.com/opencfp/opencfp/pull/196.diff","patch_url":"https://github.com/opencfp/opencfp/pull/196.patch"},"body":"This pull request patches a flaw in how profile images are managed that creates risk of a persistent remote code execution vulnerability. Details of the vulnerability may be released at the maintainers' discretion.\r\n\r\n- Uses `ircmaxell/random-lib` to generate reasonably random filenames whereby no part of the filename, at-rest, is controlled by a user of OpenCFP.\r\n- Adds additional checks to cleanup profile photo uploads that have yet to be cropped and permanently stored.\r\n- Adds a migration to clean existing installs of OpenCFP with regards to this vulnerability; bringing stored profile photos inline with proposed storage scheme.\r\n\r\n**Potential Future Work**\r\n\r\n- Would like to implement tests that attempt to exploit this vulnerability from an e2e perspective as well as tests that force exceptions to occur at various points in the upload/cropping process to verify that things are kept clean.\r\n- We are currently implicitly protecting ourselves from this vulnerability by executing a cropping process that removes the RCE vector. It would be nice to implement a service responsible for explicitly detecting and cleaning uploaded profile images so that in the event we ever stopped cropping, we would not become exposed again. "},"comment":{"url":"https://api.github.com/repos/opencfp/opencfp/issues/comments/103658688","html_url":"https://github.com/opencfp/opencfp/pull/196#issuecomment-103658688","issue_url":"https://api.github.com/repos/opencfp/opencfp/issues/196","id":103658688,"user":{"login":"mdwheele","id":2453394,"avatar_url":"https://avatars.githubusercontent.com/u/2453394?v=3","gravatar_id":"","url":"https://api.github.com/users/mdwheele","html_url":"https://github.com/mdwheele","followers_url":"https://api.github.com/users/mdwheele/followers","following_url":"https://api.github.com/users/mdwheele/following{/other_user}","gists_url":"https://api.github.com/users/mdwheele/gists{/gist_id}","starred_url":"https://api.github.com/users/mdwheele/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdwheele/subscriptions","organizations_url":"https://api.github.com/users/mdwheele/orgs","repos_url":"https://api.github.com/users/mdwheele/repos","events_url":"https://api.github.com/users/mdwheele/events{/privacy}","received_events_url":"https://api.github.com/users/mdwheele/received_events","type":"User","site_admin":false},"created_at":"2015-05-19T20:24:22Z","updated_at":"2015-05-19T20:24:22Z","body":"The migration submitted with this should be placed under high scrutiny. It makes destructive changes and while I have hand-tested all branches the migration covers, it deserves more than one set of eyes."}}