184596c5db
The Live service exposed two problems:
1. SSRF via PDF image rendering. The `image` node renderer passed
`node.attrs.src` straight to `@react-pdf/image`, which fetch()es any URL
with a host and fs.readFile()s a bare path. Because the Live container
shares a Docker network with api, db, redis, rabbitmq and minio, page
content could drive requests at internal-only services.
Adds `apps/live/src/lib/url-security.ts` and routes both `<Image>` call
sites through it. Unsafe srcs render a placeholder instead.
Note the existing `imageComponent` check was not a usable model: its
`startsWith("http")` test passes `http://api:8000/` and
`http://plane-minio:9000/` — every payload that matters. The scheme is
irrelevant; the destination is what has to be judged. That check is
replaced too.
Blocked: non-http(s)/data schemes, bare and relative filesystem paths,
loopback, RFC1918, CGNAT 100.64/10, link-local incl. 169.254.169.254,
multicast, reserved and test ranges, IPv6 ULA/link-local/site-local/
multicast/NAT64/6to4/Teredo/IPv4-mapped, obfuscated encodings
(2130706433, 0x7f000001, 127.1), single-label hosts (the shape of a
Compose service name), .local/.internal/.lan suffixes, embedded
credentials, and control-character scheme smuggling.
The IPv6 ranges are kept in step with the Python guard's
_BLOCKED_NETWORKS in apps/api/plane/utils/ip_address.py; the first draft
here was missing Teredo and fec0::/10, and two implementations of one
policy drifting apart is how this class of bug keeps recurring.
2. Unauthenticated /convert-document/. `requireSecretKey` existed but was
applied to no controller, leaving an expensive HTML -> Y.js conversion
open to anyone who could reach the service (CWE-306). It is now applied.
Its only caller — the API's copy_s3_object duplication task — sent
`headers=None`, so it now sends the shared secret, and
LIVE_SERVER_SECRET_KEY is wired into Django settings (it was previously
only in .env.example). A missing key short-circuits with a logged
misconfiguration rather than firing a request that can only 401.
Scope notes:
- /pdf-export/ is deliberately untouched. It is not unauthenticated: it
requires a Cookie and forwards it to the API to fetch the page, so the
API enforces page permissions. Gating it on the shared secret would
break the browser client that design implies.
- /convert-document/ performs no outbound fetch, and its output is never
fed to /pdf-export/, which reads content from the API by pageId.
- Residual DNS rebinding on the http(s) path is documented in the helper
and NOT closed here: the renderer is synchronous and the fetch happens
inside @react-pdf/image, so the resolved address cannot be pinned.
Closing it means pre-fetching raw image nodes into data: URIs the way
imageComponent already pre-fetches assets. Follow-up to SECUR-245.
Tests: 78 new Live tests covering every blocked payload plus range
boundaries, and 6 API tests for the header contract and the
missing-key/no-live-url paths.
Co-authored-by: Plane AI <noreply@plane.so>
Modern project management for all teams
Website • Forum • X • Documentation
Meet Plane, an open-source project management tool to track issues, run sprints cycles, and manage product roadmaps without the chaos of managing the tool itself. 🧘♀️
Plane is evolving every day. Your suggestions, ideas, and reported bugs help us immensely. Do not hesitate to join in the conversation on Forum or raise a GitHub issue. We read everything and respond to most.
🚀 Installation
Getting started with Plane is simple. Choose the setup that works best for you:
-
Plane Cloud Sign up for a free account on Plane Cloud—it's the fastest way to get up and running without worrying about infrastructure.
-
Self-host Plane Prefer full control over your data and infrastructure? Install and run Plane on your own servers. Follow our detailed deployment guides to get started.
| Installation methods | Docs link |
|---|---|
| Docker |  |
| Kubernetes |  |
| Managed hosting |  |
Instance admins can configure instance settings with God mode.
🌟 Features
-
Work Items Efficiently create and manage tasks with a robust rich text editor that supports file uploads. Enhance organization and tracking by adding sub-properties and referencing related issues.
-
Cycles Maintain your team’s momentum with Cycles. Track progress effortlessly using burn-down charts and other insightful tools.
-
Modules Simplify complex projects by dividing them into smaller, manageable modules.
-
Views Customize your workflow by creating filters to display only the most relevant issues. Save and share these views with ease.
-
Pages Capture and organize ideas using Plane Pages, complete with AI capabilities and a rich text editor. Format text, insert images, add hyperlinks, or convert your notes into actionable items.
-
Analytics Access real-time insights across all your Plane data. Visualize trends, remove blockers, and keep your projects moving forward.
🛠️ Local development
See CONTRIBUTING
⚙️ Built with
📸 Screenshots
📝 Documentation
Explore Plane's product documentation and developer documentation to learn about features, setup, and usage.
❤️ Community
Join the Plane community on GitHub Discussions and our Forum. We follow a Code of conduct in all our community channels.
Feel free to ask questions, report bugs, participate in discussions, share ideas, request features, or showcase your projects. We’d love to hear from you!
🛡️ Security
If you discover a security vulnerability in Plane, please report it responsibly instead of opening a public issue. We take all legitimate reports seriously and will investigate them promptly. See Security policy for more info.
To disclose any security issues, please email us at security@plane.so.
🤝 Contributing
There are many ways you can contribute to Plane:
- Report bugs or submit feature requests.
- Review the documentation and submit pull requests to improve it—whether it's fixing typos or adding new content.
- Talk or write about Plane or any other ecosystem integration and let us know!
- Show your support by upvoting popular feature requests.
Please read CONTRIBUTING.md for details on the process for submitting pull requests to us.
Repo activity
We couldn't have done this without you.
License
This project is licensed under the GNU Affero General Public License v3.0.