From a4fa2ec9af769ac160f3e1a60c3273a6f991b9fc Mon Sep 17 00:00:00 2001 From: Oneric Date: Sat, 9 Mar 2024 22:41:26 +0100 Subject: [PATCH] StealEmoji: make final paths infeasible to predict MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Certain attacks rely on predictable paths for their payloads. If we weren’t so overly lax in our (id, URL) check, the current counterfeit activity exploit would be one of those. It seems plausible for future attacks to hinge on or being made easier by predictable paths too. In general, letting remote actors place arbitrary data at a path within our domain of their choosing (sans prefix) just doesn’t seem like a good idea. Using fully random filenames would have worked as well, but this is less friendly for admins checking emoji dirs. The generated suffix should still be more than enough; an attacker needs on average 140 trillion attempts to correctly guess the final path. --- .../web/activity_pub/mrf/steal_emoji_policy.ex | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex index ed421d93e..3a6eae3f2 100644 --- a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex +++ b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex @@ -37,7 +37,16 @@ defp load_or_create_pack() do defp add_emoji(shortcode, extension, filedata) do {:ok, pack} = load_or_create_pack() - filename = shortcode <> "." <> extension + # Make final path infeasible to predict to thwart certain kinds of attacks + # (48 bits is slighty more than 8 base62 chars, thus 9 chars) + salt = + :crypto.strong_rand_bytes(6) + |> :crypto.bytes_to_integer() + |> Base62.encode() + |> String.pad_leading(9, "0") + + filename = shortcode <> "-" <> salt <> "." <> extension + Pack.add_file(pack, shortcode, filename, filedata) end @@ -71,7 +80,7 @@ defp steal_emoji(%{} = response, {shortcode, extension}) do e -> Logger.warning( - "MRF.StealEmojiPolicy: Failed to add #{shortcode}.#{extension}: #{inspect(e)}" + "MRF.StealEmojiPolicy: Failed to add #{shortcode} as #{extension}: #{inspect(e)}" ) nil