From 4b40cda9107709289dd2d91fd01b0f4a1351c9f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Garc=C3=ADa?= Date: Mon, 18 Mar 2019 22:12:39 +0100 Subject: [PATCH] Added domain blacklist regex for icons service and improved valid domain check. Reorganized the icons code a bit. --- .env.template | 10 +++++ src/api/icons.rs | 97 ++++++++++++++++++++++++++++++++++-------------- src/config.rs | 3 ++ 3 files changed, 82 insertions(+), 28 deletions(-) diff --git a/.env.template b/.env.template index eda99d78..83a2f7fa 100644 --- a/.env.template +++ b/.env.template @@ -62,6 +62,16 @@ ## The default is 10 seconds, but this could be to low on slower network connections # ICON_DOWNLOAD_TIMEOUT=10 +## Icon blacklist Regex +## Any domains or IPs that match this regex won't be fetched by the icon service. +## Useful to hide other servers in the local network. Check the WIKI for more details +# ICON_BLACKLIST_REGEX=192\.168\.1\.[0-9].*^ + +## Disable 2FA remember +## Enabling this would force the users to use a second factor to login every time. +## Note that the checkbox would still be present, but ignored. +# DISABLE_2FA_REMEMBER=false + ## Controls if new users can register # SIGNUPS_ALLOWED=true diff --git a/src/api/icons.rs b/src/api/icons.rs index af0442bd..3ed726a5 100644 --- a/src/api/icons.rs +++ b/src/api/icons.rs @@ -22,6 +22,8 @@ pub fn routes() -> Vec { const FALLBACK_ICON: &[u8; 344] = include_bytes!("../static/fallback-icon.png"); +const ALLOWED_CHARS: &str = "_-."; + lazy_static! { // Reuse the client between requests static ref CLIENT: Client = Client::builder() @@ -32,15 +34,42 @@ lazy_static! { .unwrap(); } +fn is_valid_domain(domain: &str) -> bool { + // Don't allow empty or too big domains or path traversal + if domain.is_empty() || domain.len() > 255 || domain.contains("..") { + return false; + } + + // Only alphanumeric or specific characters + for c in domain.chars() { + if !c.is_alphanumeric() && !ALLOWED_CHARS.contains(c) { + return false; + } + } + + true +} + #[get("//icon.png")] fn icon(domain: String) -> Content> { let icon_type = ContentType::new("image", "x-icon"); - // Validate the domain to avoid directory traversal attacks - if domain.contains('/') || domain.contains("..") { + if !is_valid_domain(&domain) { + warn!("Invalid domain: {:#?}", domain); return Content(icon_type, FALLBACK_ICON.to_vec()); } + if let Some(blacklist) = CONFIG.icon_blacklist_regex() { + info!("Icon blacklist enabled: {:#?}", blacklist); + + let regex = Regex::new(&blacklist).expect("Valid Regex"); + + if regex.is_match(&domain) { + warn!("Blacklisted domain: {:#?}", domain); + return Content(icon_type, FALLBACK_ICON.to_vec()); + } + } + let icon = get_icon(&domain); Content(icon_type, icon) @@ -132,11 +161,17 @@ fn icon_is_expired(path: &str) -> bool { } #[derive(Debug)] -struct IconList { +struct Icon { priority: u8, href: String, } +impl Icon { + fn new(priority: u8, href: String) -> Self { + Self { href, priority } + } +} + /// Returns a Result/Tuple which holds a Vector IconList and a string which holds the cookies from the last response. /// There will always be a result with a string which will contain https://example.com/favicon.ico and an empty string for the cookies. /// This does not mean that that location does exists, but it is the default location browser use. @@ -149,13 +184,13 @@ struct IconList { /// let (mut iconlist, cookie_str) = get_icon_url("github.com")?; /// let (mut iconlist, cookie_str) = get_icon_url("gitlab.com")?; /// ``` -fn get_icon_url(domain: &str) -> Result<(Vec, String), Error> { +fn get_icon_url(domain: &str) -> Result<(Vec, String), Error> { // Default URL with secure and insecure schemes let ssldomain = format!("https://{}", domain); let httpdomain = format!("http://{}", domain); // Create the iconlist - let mut iconlist: Vec = Vec::new(); + let mut iconlist: Vec = Vec::new(); // Create the cookie_str to fill it all the cookies from the response // These cookies can be used to request/download the favicon image. @@ -167,13 +202,16 @@ fn get_icon_url(domain: &str) -> Result<(Vec, String), Error> { // Extract the URL from the respose in case redirects occured (like @ gitlab.com) let url = content.url().clone(); let raw_cookies = content.headers().get_all("set-cookie"); - cookie_str = raw_cookies.iter().map(|raw_cookie| { - let cookie = Cookie::parse(raw_cookie.to_str().unwrap_or_default()).unwrap(); - format!("{}={}; ", cookie.name(), cookie.value()) - }).collect::(); + cookie_str = raw_cookies + .iter() + .map(|raw_cookie| { + let cookie = Cookie::parse(raw_cookie.to_str().unwrap_or_default()).unwrap(); + format!("{}={}; ", cookie.name(), cookie.value()) + }) + .collect::(); // Add the default favicon.ico to the list with the domain the content responded from. - iconlist.push(IconList { priority: 35, href: url.join("/favicon.ico").unwrap().into_string() }); + iconlist.push(Icon::new(35, url.join("/favicon.ico").unwrap().into_string())); let soup = Soup::from_reader(content)?; // Search for and filter @@ -185,15 +223,17 @@ fn get_icon_url(domain: &str) -> Result<(Vec, String), Error> { // Loop through all the found icons and determine it's priority for favicon in favicons { - let sizes = favicon.get("sizes").unwrap_or_default(); - let href = url.join(&favicon.get("href").unwrap_or_default()).unwrap().into_string(); - let priority = get_icon_priority(&href, &sizes); + let sizes = favicon.get("sizes"); + let href = favicon.get("href").expect("Missing href"); + let full_href = url.join(&href).unwrap().into_string(); - iconlist.push(IconList { priority, href }) + let priority = get_icon_priority(&full_href, sizes); + + iconlist.push(Icon::new(priority, full_href)) } } else { // Add the default favicon.ico to the list with just the given domain - iconlist.push(IconList { priority: 35, href: format!("{}/favicon.ico", ssldomain) }); + iconlist.push(Icon::new(35, format!("{}/favicon.ico", ssldomain))); } // Sort the iconlist by priority @@ -204,12 +244,16 @@ fn get_icon_url(domain: &str) -> Result<(Vec, String), Error> { } fn get_page(url: &str) -> Result { - //CLIENT.get(url).send()?.error_for_status().map_err(Into::into) get_page_with_cookies(url, "") } fn get_page_with_cookies(url: &str, cookie_str: &str) -> Result { - CLIENT.get(url).header("cookie", cookie_str).send()?.error_for_status().map_err(Into::into) + CLIENT + .get(url) + .header("cookie", cookie_str) + .send()? + .error_for_status() + .map_err(Into::into) } /// Returns a Integer with the priority of the type of the icon which to prefer. @@ -224,7 +268,7 @@ fn get_page_with_cookies(url: &str, cookie_str: &str) -> Result /// priority1 = get_icon_priority("http://example.com/path/to/a/favicon.png", "32x32"); /// priority2 = get_icon_priority("https://example.com/path/to/a/favicon.ico", ""); /// ``` -fn get_icon_priority(href: &str, sizes: &str) -> u8 { +fn get_icon_priority(href: &str, sizes: Option) -> u8 { // Check if there is a dimension set let (width, height) = parse_sizes(sizes); @@ -272,11 +316,11 @@ fn get_icon_priority(href: &str, sizes: &str) -> u8 { /// let (width, height) = parse_sizes("x128x128"); // (128, 128) /// let (width, height) = parse_sizes("32"); // (0, 0) /// ``` -fn parse_sizes(sizes: &str) -> (u16, u16) { +fn parse_sizes(sizes: Option) -> (u16, u16) { let mut width: u16 = 0; let mut height: u16 = 0; - if !sizes.is_empty() { + if let Some(sizes) = sizes { match Regex::new(r"(?x)(\d+)\D*(\d+)").unwrap().captures(sizes.trim()) { None => {} Some(dimensions) => { @@ -292,21 +336,18 @@ fn parse_sizes(sizes: &str) -> (u16, u16) { } fn download_icon(domain: &str) -> Result, Error> { - let (mut iconlist, cookie_str) = get_icon_url(&domain)?; + let (iconlist, cookie_str) = get_icon_url(&domain)?; let mut buffer = Vec::new(); - iconlist.truncate(5); - for icon in iconlist { - let url = icon.href; - info!("Downloading icon for {} via {}...", domain, url); - match get_page_with_cookies(&url, &cookie_str) { + for icon in iconlist.iter().take(5) { + match get_page_with_cookies(&icon.href, &cookie_str) { Ok(mut res) => { - info!("Download finished for {}", url); + info!("Downloaded icon from {}", icon.href); res.copy_to(&mut buffer)?; break; } - Err(_) => info!("Download failed for {}", url), + Err(_) => info!("Download failed for {}", icon.href), }; } diff --git a/src/config.rs b/src/config.rs index e93eda5f..9ae5e6d0 100644 --- a/src/config.rs +++ b/src/config.rs @@ -259,6 +259,9 @@ make_config! { icon_cache_negttl: u64, true, def, 259_200; /// Icon download timeout |> Number of seconds when to stop attempting to download an icon. icon_download_timeout: u64, true, def, 10; + /// Icon blacklist Regex |> Any domains or IPs that match this regex won't be fetched by the icon service. + /// Useful to hide other servers in the local network. Check the WIKI for more details + icon_blacklist_regex: String, true, option; /// Disable Two-Factor remember |> Enabling this would force the users to use a second factor to login every time. /// Note that the checkbox would still be present, but ignored.