Page MenuHomePhabricator

Have SvgHandler create a directory for its RSVG input files
Closed, ResolvedPublic

Description

RSVG has recently changed its external entity expansion policy, from allowing access to all local files to only allowing files in the same directory as the input file. This is not sufficiently secure for us as it is, since input files are typically in /tmp and there may be all sorts of private data in /tmp, owned by apache.

However, it would be nice to securely support the new stock RSVG, so that we can stop maintaining our security patch, and so that external users can use RSVG without patching it. So, I propose having SvgHandler create a new temporary directory on transform, and having it copy (or symlink if RSVG's security policy allows) the source files into that directory.

We are planning on migrating to Ubuntu 14.04 soon, which means either porting the security patch or implementing this proposal, hence it is fairly urgent.


Version: unspecified
Severity: normal

Details

Reference
bz67402

Event Timeline

bzimport raised the priority of this task from to Normal.Nov 22 2014, 3:26 AM
bzimport set Reference to bz67402.
tstarling created this task.Jul 2 2014, 1:04 AM

Change 145232 had a related patch set uploaded by Aaron Schulz:
[WIP] Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/145232

Change 145232 merged by jenkins-bot:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/145232

Change 150255 had a related patch set uploaded by Aaron Schulz:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150255

Change 150268 had a related patch set uploaded by Aaron Schulz:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150268

Change 150255 merged by jenkins-bot:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150255

Change 150269 had a related patch set uploaded by Aaron Schulz:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150269

Change 150269 merged by jenkins-bot:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150269

Change 150268 merged by jenkins-bot:
Have SvgHandler create a directory for its RSVG input files

https://gerrit.wikimedia.org/r/150268

Gilles raised the priority of this task from Normal to Unbreak Now!.Dec 4 2014, 10:19 AM
Gilles added a project: Multimedia.
Gilles moved this task from Untriaged to Done on the Multimedia board.
Gilles lowered the priority of this task from Unbreak Now! to Normal.Dec 4 2014, 11:22 AM