railspress-engine 1.4.3 → 1.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a843f07c6d903605a67314573c816bbff6099640947e622e9c59a89ff88cbea
-  data.tar.gz: 17f4e1697c1dd88947460d5e93cb42cee3652677ce69fc456e4da1821e56b9b1
+  metadata.gz: 48860d966cd3cdc8832ba51098ea94bf8b7264608105231af1b7871d4576d1c8
+  data.tar.gz: e4e9e1631fa9127c0c221e08c081e5280e85a7f7f7f3716814033f722aac921b
 SHA512:
-  metadata.gz: 9bb75c97d3ace5d1fb54d6281d6ce4c2d17ac29cfd3d71821ba92cb22ecb7b4634a60b1015b0226755b52bc75e778d5ef9f1062976382843a03faa6b686990c8
-  data.tar.gz: 2aaca7f4a20c3f875bac0c37817f5eadb853c317ef72bf9d00100ad5ddf865ed000214b8e0e15155dd90033b21a1b1426a7ce3f576d610e5819398e6aa535ca7
+  metadata.gz: 0523661e660f0d5490b95282ed786669282ea2edfe29a84397fafd10c22e1c599d383a9a40c4b3e2c1e9efa4476a82e24a5236a231c44d27041355986a100803
+  data.tar.gz: 699ae2eba634ef60e19f7c18b8f98bbd3470c61dcaa750eeff7d6ece5a07436bd33ab19e37740540f93f3621c3961bb3066abcb650717d1658cbc8b24232a97d

data/README.md

@@ -157,6 +157,16 @@ end
 
 See [CONFIGURING.md](docs/CONFIGURING.md) for more authentication patterns including Devise integration.
 
+## Import Security
+
+RailsPress stores imported files inside engine-owned temporary directories.
+
+ZIP image references cannot escape their extraction directory.
+
+Remote header images accept public HTTP and HTTPS destinations. Private and redirected destinations are rejected.
+
+Configure request and worker limits for additional availability protection.
+
 ## Quick Start
 
 Access the admin at `/railspress/admin`. From there you can manage posts, entities, and blocks.

data/app/controllers/railspress/admin/imports_controller.rb

@@ -1,6 +1,8 @@
 module Railspress
   module Admin
     class ImportsController < BaseController
+      SUPPORTED_IMPORT_EXTENSIONS = %w[.md .markdown .txt .zip].freeze
+
       before_action :validate_import_type, only: [ :show ]
 
       def show
@@ -53,11 +55,18 @@ module Railspress
         FileUtils.mkdir_p(upload_dir)
 
         uploaded_files.map do |file|
-          path = upload_dir.join(file.original_filename)
+          path = upload_dir.join(stored_upload_name(file))
           File.open(path, "wb") { |f| f.write(file.read) }
           path.to_s
         end
       end
+
+      def stored_upload_name(file)
+        extension = File.extname(file.original_filename.to_s).downcase
+        extension = "" unless SUPPORTED_IMPORT_EXTENSIONS.include?(extension)
+
+        "#{SecureRandom.hex(16)}#{extension}"
+      end
     end
   end
 end

data/app/jobs/railspress/import_posts_job.rb

@@ -30,12 +30,15 @@ module Railspress
     end
 
     def cleanup_uploaded_files(file_paths)
-      tmp_dir = Rails.root.join("tmp").to_s
+      tmp_dir = File.realpath(Rails.root.join("tmp"))
 
       file_paths.each do |path|
-        # Only cleanup files in the tmp directory to avoid deleting source files
-        next unless path.start_with?(tmp_dir)
-        FileUtils.rm_f(path) if File.exist?(path)
+        next unless File.exist?(path)
+
+        resolved_path = File.realpath(path)
+        next unless resolved_path.start_with?("#{tmp_dir}#{File::SEPARATOR}")
+
+        FileUtils.rm_f(resolved_path)
       end
     rescue => e
       Rails.logger.warn "Failed to cleanup uploaded import files: #{e.message}"

data/app/models/railspress/post_import_processor.rb

@@ -1,8 +1,9 @@
 require "yaml"
 require "zip"
-require "open-uri"
 require "fileutils"
 require "redcarpet"
+require "ssrf_filter"
+require "stringio"
 
 module Railspress
   class PostImportProcessor
@@ -211,29 +212,20 @@ module Railspress
       filename = File.basename(uri.path)
       filename = "header_image#{File.extname(uri.path)}" if filename.blank?
 
-      downloaded = URI.open(url)
+      response = SsrfFilter.get(url, max_redirects: 0)
+      response.value
       post.header_image.attach(
-        io: downloaded,
+        io: StringIO.new(response.body),
         filename: filename,
-        content_type: downloaded.content_type
+        content_type: response.content_type
       )
-    rescue OpenURI::HTTPError, URI::InvalidURIError => e
+    rescue SsrfFilter::Error, URI::InvalidURIError, Net::HTTPError => e
       Rails.logger.warn "Failed to download header image from #{url}: #{e.message}"
     end
 
     def attach_image_from_zip(post, relative_path, source_path, base_dir)
-      # Resolve relative path from the markdown file's directory or from base_dir
-      source_dir = File.dirname(source_path)
-
-      # Try relative to the markdown file first
-      image_path = File.expand_path(relative_path, source_dir)
-
-      # If not found, try relative to base_dir
-      unless File.exist?(image_path)
-        image_path = File.expand_path(relative_path, base_dir)
-      end
-
-      return unless File.exist?(image_path)
+      image_path = imported_image_path(relative_path, source_path, base_dir)
+      return unless image_path
 
       ext = File.extname(image_path).downcase
       return unless IMAGE_EXTENSIONS.include?(ext)
@@ -253,6 +245,23 @@ module Railspress
       )
     end
 
+    def imported_image_path(relative_path, source_path, base_dir)
+      import_root = File.realpath(base_dir)
+      source_dir = File.dirname(source_path)
+
+      [ source_dir, import_root ].each do |directory|
+        candidate = File.expand_path(relative_path.to_s, directory)
+        next unless File.file?(candidate)
+
+        resolved_candidate = File.realpath(candidate)
+        return resolved_candidate if resolved_candidate.start_with?("#{import_root}#{File::SEPARATOR}")
+      end
+
+      nil
+    rescue Errno::EACCES, Errno::ENOENT
+      nil
+    end
+
     def extract_title_from_body(body)
       # Look for first H1: # Title
       if match = body.match(/^#\s+(.+)$/)

data/lib/railspress/version.rb

@@ -1,3 +1,3 @@
 module Railspress
-  VERSION = "1.4.3"
+  VERSION = "1.4.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: railspress-engine
 version: !ruby/object:Gem::Version
-  version: 1.4.3
+  version: 1.4.4
 platform: ruby
 authors:
 - Avi Flombaum
@@ -85,6 +85,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.6'
+- !ruby/object:Gem::Dependency
+  name: ssrf_filter
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement