image_vise 0.0.26 → 0.0.27

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: cb3f1e2fdb272ce247b39af0ac465622ae4aab47
-  data.tar.gz: af4c923a506fa1b8e960f06cf6ac6686a0cda9d0
+  metadata.gz: f5f04e40e483c24a0b40a0b3d2d76ae28be7570e
+  data.tar.gz: e79c48aa6995a8325d78a93870b79468e94eb4d5
 SHA512:
-  metadata.gz: 436cf6a7fcbafd57c1d531530cf42e08f8aa746fa85aa99dfd3d672e1c6ec9a49c6775387cc7f0fbd183e9abb01c75b698e7a0664b4cd65d7115294bdf334bb5
-  data.tar.gz: b72ead80e081805e1705ea8f22a69dccca06a70967a5ba731c27938aa3a20469f482c23f62789bce1f9a90d71666d570e304dd2f35e22aee85ba0fea42872a72
+  metadata.gz: 6cd787cd19a6eeef389879077ae4ee511f5a8f0bbc388433c4e4cacdb53c8d6320542703bff5d91801b86fa1926b90acbcd95596b2ff12f1fdbc4bbfd32b06ba
+  data.tar.gz: 6450c000ad114c2f0e37a1291a174e5cfead4692d8439df7d7c3583261aafbbdac6c9b36897d909a34d0cfbe936edbc5a41c1d89af11ea730f7240bf83c8d015

data/SECURITY.md

@@ -8,6 +8,18 @@ URLs are passed as Base64-encoded JSON. The JSON payload is signed using HMAC wi
 sufficient to prevent too much probing. If this is a critical issue you need to put throttling in front of the application.
 For checking HMAC values `Rack::Utils.secure_compare` constant-time comparison is used.
 
+## Cache bypass protection for randomized query string params
+
+ImageVise forbids _any_ query string params except `sig` and `q`. This to prevent the same processing
+URL from being requested repeatedly with the same params but with a different query string param appended,
+like this:
+
+* `/thm?q=xYz&sig=abc&exploit=123`
+* `/thm?q=xYz&sig=abc&exploit=234`
+
+These URLs would in fact resolve to the same source image and pipeline, but would not be stored in an upstream
+CDN cache because the query string params contain extra data.
+
 ## Protection for remote URLs from HTTP(s) origins
 
 Only URLs referring to permitted hosts are going to be permitted for fetching. If there are no host added,

data/image_vise.gemspec

@@ -2,11 +2,11 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: image_vise 0.0.26 ruby lib
+# stub: image_vise 0.0.27 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "image_vise"
-  s.version = "0.0.26"
+  s.version = "0.0.27"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]

data/lib/image_vise/image_request.rb

@@ -6,21 +6,18 @@ class ImageVise::ImageRequest < Ks.strict(:src_url, :pipeline)
   
   # Initializes a new ParamsChecker from given HTTP server framework
   # params. The params can be symbol- or string-keyed, does not matter.
-  def self.to_request(qs_params:, secrets:)
+  def self.from_params(qs_params:, secrets:)
     base64_encoded_params = qs_params.fetch(:q) rescue qs_params.fetch('q')
     given_signature = qs_params.fetch(:sig) rescue qs_params.fetch('sig')
 
-    # Decode Base64 first - this gives us a stable serialized form of the request parameters.
-    # The encoded parameters might _not_ include ==-padding at the end.
-    decoded_json = Base64.decode64(base64_encoded_params)
-
     # Check the signature before decoding JSON (since we will be creating symbols)
-    unless valid_signature?(decoded_json, given_signature, secrets)
+    unless valid_signature?(base64_encoded_params, given_signature, secrets)
       raise SignatureError, "Invalid or missing signature"
     end
 
     # Decode the JSON
     # (only AFTER the signature has been validated, so we can use symbol keys)
+    decoded_json = Base64.decode64(base64_encoded_params)
     params = JSON.parse(decoded_json, symbolize_names: true)
 
     # Pick up the URL and validate it
@@ -35,7 +32,7 @@ class ImageVise::ImageRequest < Ks.strict(:src_url, :pipeline)
   def to_query_string_params(signed_with_secret)
     payload = JSON.dump(to_h)
     base64_enc = Base64.strict_encode64(payload).gsub(/\=+$/, '')
-    {q: base64_enc, sig: OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, signed_with_secret, payload)}
+    {q: base64_enc, sig: OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, signed_with_secret, base64_enc)}
   end
 
   def to_h

data/lib/image_vise/render_engine.rb

@@ -65,10 +65,13 @@ class ImageVise::RenderEngine
     # and the client already has it. Just respond with a 304.
     return [304, DEFAULT_HEADERS.dup, []] if env['HTTP_IF_NONE_MATCH']
 
-    req = Rack::Request.new(env)
+    req = parse_env_into_request(env)
     bail(405, 'Only GET supported') unless req.get?
-
-    image_request = ImageVise::ImageRequest.to_request(qs_params: req.params, secrets: ImageVise.secret_keys)
+    
+    # Prevent cache bypass DOS attacks by only permitting :sig and :q
+    bail(400, 'Too many params') if req.params.length > 2
+    
+    image_request = ImageVise::ImageRequest.from_params(qs_params: req.params, secrets: ImageVise.secret_keys)
     render_destination_file, render_file_type, etag = process_image_request(image_request) 
     image_rack_response(render_destination_file, render_file_type, etag)
   rescue *permanent_failures => e
@@ -84,6 +87,16 @@ class ImageVise::RenderEngine
       raise_exception_or_error_response(e, 500)
     end
   end
+  
+  # Parses the Rack environment into a Rack::Reqest. The following methods
+  # are going to be called on it: `#get?` and `#params`. You can use this
+  # method to override path-to-parameter translation for example.
+  #
+  # @param rack_env[Hash] the Rack environment
+  # @return [#get?, #params] the Rack request or a compatible object
+  def parse_env_into_request(rack_env)
+    Rack::Request.new(rack_env)
+  end
 
   # Processes the ImageRequest object created from the request parameters,
   # and returns a triplet of the File object containing the rendered image,

data/lib/image_vise.rb

@@ -8,7 +8,7 @@ require 'base64'
 require 'rack'
 
 class ImageVise
-  VERSION = '0.0.26'
+  VERSION = '0.0.27'
   S_MUTEX = Mutex.new
   private_constant :S_MUTEX
   

data/spec/image_vise/image_request_spec.rb

@@ -6,25 +6,23 @@ describe ImageVise::ImageRequest do
     img_params_json = JSON.dump(img_params)
     
     q = Base64.encode64(img_params_json)
-    signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, 'this is a secret', img_params_json)
+    signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, 'this is a secret', q)
     params = {q: q, sig: signature}
 
-    image_request = described_class.to_request(qs_params: params, secrets: ['this is a secret'])
+    image_request = described_class.from_params(qs_params: params, secrets: ['this is a secret'])
     request_qs_params = image_request.to_query_string_params('this is a secret')
     expect(request_qs_params).to be_kind_of(Hash)
 
-    image_request_roundtrip = described_class.to_request(qs_params: request_qs_params, secrets: ['this is a secret'])
+    image_request_roundtrip = described_class.from_params(qs_params: request_qs_params, secrets: ['this is a secret'])
   end
 
   it 'converts a file:// URL into a URI objectlist' do
     img_params = {src_url: 'file:///etc/passwd', pipeline: [[:auto_orient, {}]]}
     img_params_json = JSON.dump(img_params)
-    signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, 'this is a secret', img_params_json)
-    params = {
-      q: Base64.encode64(img_params_json),
-      sig: signature
-    }
-    image_request = described_class.to_request(qs_params: params, secrets: ['this is a secret'])
+    q = Base64.encode64(img_params_json)
+    signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, 'this is a secret', q)
+    params = {q: q, sig: signature}
+    image_request = described_class.from_params(qs_params: params, secrets: ['this is a secret'])
     expect(image_request.src_url).to be_kind_of(URI)
   end
 
@@ -39,18 +37,6 @@ describe ImageVise::ImageRequest do
     end
   end
 
-  describe 'fails with an invalid pipeline' do
-    it 'when the pipe param is missing'
-    it 'when the pipe param is empty'
-    it 'when the pipe param cannot be parsed into a Pipeline'
-    it 'when the pipe param parses into a Pipeline with zero operators'
-  end
-
-  describe 'fails with an invalid URL' do
-    it 'when the URL param is missing'
-    it 'when the URL param is empty'
-  end
-
   describe 'fails with an invalid signature' do
     it 'when the sig param is missing'
     it 'when the sig param is empty'
@@ -58,14 +44,12 @@ describe ImageVise::ImageRequest do
       img_params = {src_url: 'http://bucket.s3.aws.com/image.jpg',
           pipeline: [[:crop, {width: 10, height: 10, gravity: 's'}]]}
       img_params_json = JSON.dump(img_params)
-      signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, 'a', img_params_json)
-      params = {
-        q: Base64.encode64(img_params_json),
-        sig: signature
-      }
+      enc = Base64.encode64(img_params_json)
+      signature = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, 'a', enc)
+      params = {q: enc, sig: signature}
       
       expect {
-        described_class.to_request(qs_params: params, secrets: ['b'])
+        described_class.from_params(qs_params: params, secrets: ['b'])
       }.to raise_error(/Invalid or missing signature/)
     end
   end

data/spec/image_vise/render_engine_spec.rb

@@ -167,6 +167,7 @@ describe ImageVise::RenderEngine do
       image_request = ImageVise::ImageRequest.new(src_url: uri.to_s, pipeline: p)
       params = image_request.to_query_string_params('l33tness')
 
+      expect(app).to receive(:parse_env_into_request).and_call_original
       expect(app).to receive(:process_image_request).and_call_original
       expect(app).to receive(:image_rack_response).and_call_original
       expect(app).to receive(:source_file_type_permitted?).and_call_original
@@ -211,6 +212,19 @@ describe ImageVise::RenderEngine do
       expect(last_response.headers['Content-Type']).to eq('image/jpeg')
     end
 
+    it 'forbids a request with an extra GET param' do
+      uri = 'file://' + URI.encode(test_image_path)
+
+      p = ImageVise::Pipeline.new.fit_crop(width: 10, height: 10, gravity: 'c')
+      image_request = ImageVise::ImageRequest.new(src_url: uri.to_s, pipeline: p)
+      params = image_request.to_query_string_params('l33tness')
+
+      params[:extra] = '123'
+      get '/', params
+
+      expect(last_response.status).to eq(400)
+    end
+
     it 'returns the processed JPEG image as a PNG if it had to get an alpha channel during processing' do
       uri = Addressable::URI.parse(public_url)
       ImageVise.add_allowed_host!(uri.host)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: image_vise
 version: !ruby/object:Gem::Version
-  version: 0.0.26
+  version: 0.0.27
 platform: ruby
 authors:
 - Julik Tarkhanov