diff options
| -rw-r--r-- | src/Text/Pandoc/Class/IO.hs | 2 | ||||
| -rw-r--r-- | src/Text/Pandoc/MediaBag.hs | 7 | ||||
| -rw-r--r-- | test/Tests/MediaBag.hs | 12 |
3 files changed, 17 insertions, 4 deletions
diff --git a/src/Text/Pandoc/Class/IO.hs b/src/Text/Pandoc/Class/IO.hs index 86ed83c89..2ae3b5cee 100644 --- a/src/Text/Pandoc/Class/IO.hs +++ b/src/Text/Pandoc/Class/IO.hs @@ -224,6 +224,8 @@ writeMedia :: (PandocMonad m, MonadIO m) -> m () writeMedia dir (fp, _mt, bs) = do -- we normalize to get proper path separators for the platform + -- we unescape URI encoding, but given how insertMedia + -- is written, we shouldn't have any % in a canonical media name... let fullpath = normalise $ dir </> unEscapeString fp liftIOError (createDirectoryIfMissing True) (takeDirectory fullpath) report $ Extracting (T.pack fullpath) diff --git a/src/Text/Pandoc/MediaBag.hs b/src/Text/Pandoc/MediaBag.hs index bb75f4591..18a40a6dc 100644 --- a/src/Text/Pandoc/MediaBag.hs +++ b/src/Text/Pandoc/MediaBag.hs @@ -90,16 +90,17 @@ insertMedia fp mbMime contents (MediaBag mediamap) = && Windows.isRelative fp'' && isNothing uri && not (".." `isInfixOf` fp'') + && '%' `notElem` fp'' then fp'' - else showDigest (sha1 contents) <> "." <> ext + else showDigest (sha1 contents) <> ext fallback = case takeExtension fp'' of ".gz" -> getMimeTypeDef $ dropExtension fp'' _ -> getMimeTypeDef fp'' mt = fromMaybe fallback mbMime path = maybe fp'' (unEscapeString . uriPath) uri ext = case takeExtension path of - '.':e -> e - _ -> maybe "" T.unpack $ extensionFromMimeType mt + '.':e | '%' `notElem` e -> '.':e + _ -> maybe "" (\x -> '.':T.unpack x) $ extensionFromMimeType mt -- | Lookup a media item in a 'MediaBag', returning mime type and contents. lookupMedia :: FilePath diff --git a/test/Tests/MediaBag.hs b/test/Tests/MediaBag.hs index 65b6716d9..4cb4ab807 100644 --- a/test/Tests/MediaBag.hs +++ b/test/Tests/MediaBag.hs @@ -20,7 +20,7 @@ tests = [ let d = B.doc $ B.para (B.image "../../test/lalune.jpg" "" mempty) <> B.para (B.image "moon.jpg" "" mempty) <> - B.para (B.image "data://image/png;base64,cHJpbnQgImhlbGxvIgo=;.lua+%2f%2e%2e%2f%2e%2e%2fa%2elua" "" mempty) <> + B.para (B.image "data:image/png;base64,cHJpbnQgImhlbGxvIgo=;.lua+%2f%2e%2e%2f%2e%2e%2fa%2elua" "" mempty) <> B.para (B.image "data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" "" mempty) runIOorExplode $ do fillMediaBag d @@ -35,4 +35,14 @@ tests = [ (exists3 && not exists4) exists5 <- doesFileExist ("foo" </> "d5fceb6532643d0d84ffe09c40c481ecdf59e15a.gif") assertBool "data uri with gif is not properly decoded" exists5 + -- double-encoded version: + let e = B.doc $ + B.para (B.image "data:image/png;base64,cHJpbnQgInB3bmVkIgo=;.lua+%252f%252e%252e%252f%252e%252e%252fb%252elua" "" mempty) + runIOorExplode $ do + fillMediaBag e + extractMedia "bar" e + exists6 <- doesFileExist ("bar" </> "772ceca21a2751863ec46cb23db0e7fc35b9cff8.png") + exists7 <- doesFileExist "b.lua" + assertBool "data uri with double-encoded malicious payload gets written outside of destination dir" + (exists6 && not exists7) ] |