mirror of
https://github.com/makeplane/plane.git
synced 2026-09-03 04:29:57 +02:00
184596c5db
The Live service exposed two problems:
1. SSRF via PDF image rendering. The `image` node renderer passed
`node.attrs.src` straight to `@react-pdf/image`, which fetch()es any URL
with a host and fs.readFile()s a bare path. Because the Live container
shares a Docker network with api, db, redis, rabbitmq and minio, page
content could drive requests at internal-only services.
Adds `apps/live/src/lib/url-security.ts` and routes both `<Image>` call
sites through it. Unsafe srcs render a placeholder instead.
Note the existing `imageComponent` check was not a usable model: its
`startsWith("http")` test passes `http://api:8000/` and
`http://plane-minio:9000/` — every payload that matters. The scheme is
irrelevant; the destination is what has to be judged. That check is
replaced too.
Blocked: non-http(s)/data schemes, bare and relative filesystem paths,
loopback, RFC1918, CGNAT 100.64/10, link-local incl. 169.254.169.254,
multicast, reserved and test ranges, IPv6 ULA/link-local/site-local/
multicast/NAT64/6to4/Teredo/IPv4-mapped, obfuscated encodings
(2130706433, 0x7f000001, 127.1), single-label hosts (the shape of a
Compose service name), .local/.internal/.lan suffixes, embedded
credentials, and control-character scheme smuggling.
The IPv6 ranges are kept in step with the Python guard's
_BLOCKED_NETWORKS in apps/api/plane/utils/ip_address.py; the first draft
here was missing Teredo and fec0::/10, and two implementations of one
policy drifting apart is how this class of bug keeps recurring.
2. Unauthenticated /convert-document/. `requireSecretKey` existed but was
applied to no controller, leaving an expensive HTML -> Y.js conversion
open to anyone who could reach the service (CWE-306). It is now applied.
Its only caller — the API's copy_s3_object duplication task — sent
`headers=None`, so it now sends the shared secret, and
LIVE_SERVER_SECRET_KEY is wired into Django settings (it was previously
only in .env.example). A missing key short-circuits with a logged
misconfiguration rather than firing a request that can only 401.
Scope notes:
- /pdf-export/ is deliberately untouched. It is not unauthenticated: it
requires a Cookie and forwards it to the API to fetch the page, so the
API enforces page permissions. Gating it on the shared secret would
break the browser client that design implies.
- /convert-document/ performs no outbound fetch, and its output is never
fed to /pdf-export/, which reads content from the API by pageId.
- Residual DNS rebinding on the http(s) path is documented in the helper
and NOT closed here: the renderer is synchronous and the fetch happens
inside @react-pdf/image, so the resolved address cannot be pinned.
Closing it means pre-fetching raw image nodes into data: URIs the way
imageComponent already pre-fetches assets. Follow-up to SECUR-245.
Tests: 78 new Live tests covering every blocked payload plus range
boundaries, and 6 API tests for the header contract and the
missing-key/no-live-url paths.
Co-authored-by: Plane AI <noreply@plane.so>