From d0e2023a63d7a158f275a79a57356f769c54ee01 Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Thu, 25 Jun 2020 22:20:58 +0200 Subject: [PATCH] [ticket/security-259] Stop checking image size of images in img bbcode SECURITY-259 --- phpBB/includes/message_parser.php | 26 ---------------- phpBB/phpbb/textformatter/s9e/factory.php | 2 -- phpBB/phpbb/textformatter/s9e/parser.php | 28 ++--------------- tests/text_processing/message_parser_test.php | 30 ------------------- 4 files changed, 2 insertions(+), 84 deletions(-) diff --git a/phpBB/includes/message_parser.php b/phpBB/includes/message_parser.php index e1c28223dc..7bd444b4a3 100644 --- a/phpBB/includes/message_parser.php +++ b/phpBB/includes/message_parser.php @@ -401,32 +401,6 @@ class bbcode_firstpass extends bbcode $in = 'http://' . $in; } - if ($config['max_' . $this->mode . '_img_height'] || $config['max_' . $this->mode . '_img_width']) - { - $imagesize = new \FastImageSize\FastImageSize(); - $size_info = $imagesize->getImageSize(htmlspecialchars_decode($in)); - - if ($size_info === false) - { - $error = true; - $this->warn_msg[] = $user->lang['UNABLE_GET_IMAGE_SIZE']; - } - else - { - if ($config['max_' . $this->mode . '_img_height'] && $config['max_' . $this->mode . '_img_height'] < $size_info['height']) - { - $error = true; - $this->warn_msg[] = $user->lang('MAX_IMG_HEIGHT_EXCEEDED', (int) $config['max_' . $this->mode . '_img_height']); - } - - if ($config['max_' . $this->mode . '_img_width'] && $config['max_' . $this->mode . '_img_width'] < $size_info['width']) - { - $error = true; - $this->warn_msg[] = $user->lang('MAX_IMG_WIDTH_EXCEEDED', (int) $config['max_' . $this->mode . '_img_width']); - } - } - } - if ($error || $this->path_in_domain($in)) { return '[img]' . $in . '[/img]'; diff --git a/phpBB/phpbb/textformatter/s9e/factory.php b/phpBB/phpbb/textformatter/s9e/factory.php index 725844e2d3..7b79405f7e 100644 --- a/phpBB/phpbb/textformatter/s9e/factory.php +++ b/phpBB/phpbb/textformatter/s9e/factory.php @@ -273,8 +273,6 @@ class factory implements \phpbb\textformatter\cache_interface ->add('#imageurl', __NAMESPACE__ . '\\parser::filter_img_url') ->addParameterByName('urlConfig') ->addParameterByName('logger') - ->addParameterByName('max_img_height') - ->addParameterByName('max_img_width') ->markAsSafeAsURL() ->setJS('UrlFilter.filter'); diff --git a/phpBB/phpbb/textformatter/s9e/parser.php b/phpBB/phpbb/textformatter/s9e/parser.php index 1151f09898..590afc0ebc 100644 --- a/phpBB/phpbb/textformatter/s9e/parser.php +++ b/phpBB/phpbb/textformatter/s9e/parser.php @@ -380,11 +380,10 @@ class parser implements \phpbb\textformatter\parser_interface * @param string $url Original URL * @param array $url_config Config used by the URL filter * @param Logger $logger - * @param integer $max_height Maximum height allowed - * @param integer $max_width Maximum width allowed + * * @return string|bool Original value if valid, FALSE otherwise */ - static public function filter_img_url($url, array $url_config, Logger $logger, $max_height, $max_width) + static public function filter_img_url($url, array $url_config, Logger $logger) { // Validate the URL $url = UrlFilter::filter($url, $url_config, $logger); @@ -393,29 +392,6 @@ class parser implements \phpbb\textformatter\parser_interface return false; } - if ($max_height || $max_width) - { - $imagesize = new \FastImageSize\FastImageSize(); - $size_info = $imagesize->getImageSize($url); - if ($size_info === false) - { - $logger->err('UNABLE_GET_IMAGE_SIZE'); - return false; - } - - if ($max_height && $max_height < $size_info['height']) - { - $logger->err('MAX_IMG_HEIGHT_EXCEEDED', array('max_height' => $max_height)); - return false; - } - - if ($max_width && $max_width < $size_info['width']) - { - $logger->err('MAX_IMG_WIDTH_EXCEEDED', array('max_width' => $max_width)); - return false; - } - } - return $url; } diff --git a/tests/text_processing/message_parser_test.php b/tests/text_processing/message_parser_test.php index a3dbf644f6..d302ee9504 100644 --- a/tests/text_processing/message_parser_test.php +++ b/tests/text_processing/message_parser_test.php @@ -342,26 +342,6 @@ class phpbb_text_processing_message_parser_test extends phpbb_test_case }, array('You may only use fonts up to size 120.') ), - array( - '[img]http://example.org/100x100.png[/img]', - '[img]http://example.org/100x100.png[/img]', - array(true, true, true, true, true, true, true), - function ($phpbb_container) - { - $phpbb_container->get('config')->set('max_post_img_height', 12); - }, - array('Your images may only be up to 12 pixels high.') - ), - array( - '[img]http://example.org/100x100.png[/img]', - '[img]http://example.org/100x100.png[/img]', - array(true, true, true, true, true, true, true), - function ($phpbb_container) - { - $phpbb_container->get('config')->set('max_post_img_width', 34); - }, - array('Your images may only be up to 34 pixels wide.') - ), array( '[img]http://example.org/100x100.png[/img]', '[img]http://example.org/100x100.png[/img]', @@ -392,16 +372,6 @@ class phpbb_text_processing_message_parser_test extends phpbb_test_case $phpbb_container->get('config')->set('max_sig_img_width', 34); } ), - array( - '[img]http://example.org/404.png[/img]', - '[img]http://example.org/404.png[/img]', - array(true, true, true, true, true, true, true), - function ($phpbb_container) - { - $phpbb_container->get('config')->set('max_post_img_height', 12); - }, - array('It was not possible to determine the dimensions of the image.') - ), array( '[flash=999,999]http://example.org/foo.swf[/flash]', '[flash=999,999]http://example.org/foo.swf[/flash]',