Last modified: 2014-07-29 20:56:28 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T69402, the corresponding Phabricator task for complete and up-to-date bug report information.

Bug 67402 - Have SvgHandler create a directory for its RSVG input files


Summary:	Have SvgHandler create a directory for its RSVG input files

Status:	RESOLVED FIXED

Product:	MediaWiki
Classification:	Unclassified
Component:	File management (Other open bugs)
Version:	unspecified
Hardware:	All All

Importance:	Normal normal (vote)
Target Milestone:	---
Assigned To:	Aaron Schulz

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2014-07-02 01:04 UTC by Tim Starling
Modified:	2014-07-29 20:56 UTC (History)
CC List:	6 users (show)

See Also:
Web browser:	---
Mobile Platform:	---
Assignee Huggle Beta Tester:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Tim Starling 2014-07-02 01:04:34 UTC

RSVG has recently changed its external entity expansion policy, from allowing access to all local files to only allowing files in the same directory as the input file. This is not sufficiently secure for us as it is, since input files are typically in /tmp and there may be all sorts of private data in /tmp, owned by apache.

However, it would be nice to securely support the new stock RSVG, so that we can stop maintaining our security patch, and so that external users can use RSVG without patching it. So, I propose having SvgHandler create a new temporary directory on transform, and having it copy (or symlink if RSVG's security policy allows) the source files into that directory.

We are planning on migrating to Ubuntu 14.04 soon, which means either porting the security patch or implementing this proposal, hence it is fairly urgent.

Comment 1 Gerrit Notification Bot 2014-07-10 07:15:15 UTC

Change 145232 had a related patch set uploaded by Aaron Schulz:
[WIP] Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/145232

Comment 2 Gerrit Notification Bot 2014-07-29 16:49:48 UTC

Change 145232 merged by jenkins-bot:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/145232

Comment 3 Gerrit Notification Bot 2014-07-29 17:03:38 UTC

Change 150255 had a related patch set uploaded by Aaron Schulz:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150255

Comment 4 Gerrit Notification Bot 2014-07-29 17:41:00 UTC

Change 150268 had a related patch set uploaded by Aaron Schulz:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150268

Comment 5 Gerrit Notification Bot 2014-07-29 17:42:37 UTC

Change 150255 merged by jenkins-bot:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150255

Comment 6 Gerrit Notification Bot 2014-07-29 17:47:33 UTC

Change 150269 had a related patch set uploaded by Aaron Schulz:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150269

Comment 7 Gerrit Notification Bot 2014-07-29 17:51:08 UTC

Change 150269 merged by jenkins-bot:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150269

Comment 8 Gerrit Notification Bot 2014-07-29 20:49:50 UTC

Change 150268 merged by jenkins-bot:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150268

Wikimedia Bugzilla is closed!

Search

Personal tools

Navigation

Links