Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent Upload of ZIP bombs #7407

Merged
merged 2 commits into from
May 26, 2024
Merged

Prevent Upload of ZIP bombs #7407

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
038dbbd
Added fix for zip bomb
tanmaypardeshi Apr 19, 2024
ada7a6d
Merge pull request #2 from openemr/master
tanmaypardeshi Apr 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 26 additions & 2 deletions interface/super/manage_document_templates.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,8 +99,32 @@
die(xlt('Cannot determine a destination filename'));
}
$path_parts = pathinfo($form_dest_filename);
if (!in_array(strtolower($path_parts['extension'] ?? ''), array('odt', 'txt', 'docx', 'zip'))) {
die(text(strtolower($path_parts['extension'] ?? '')) . ' ' . xlt('filetype is not accepted'));
$extension = strtolower($path_parts['extension'] ?? '');

if (!in_array($extension, array('odt', 'txt', 'docx', 'zip'))) {
die(text($extension) . ' ' . xlt('filetype is not accepted'));
}

// Check if the uploaded file is a zip file
if ($extension === 'zip') {
$maxZipSize = 1048576; // 1 MB (adjust the size as needed)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this making the max size just 1 MB ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(just checking; maybe is acceptable for manage_document_templates uploads)

Copy link
Contributor Author

@tanmaypardeshi tanmaypardeshi May 29, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes! Making sure that if it a ZIP file, a size larger than 1MB can be denied (Although, this can be changed or even removed based on what the requirements are).

if ($_FILES['form_file']['size'] > $maxZipSize) {
die(xlt('Zip file size exceeds the maximum allowed size'));
}

// Check for nested zip files
$zip = new ZipArchive;
if ($zip->open($tmp_name) === true) {
for ($i = 0; $i < $zip->numFiles; $i++) {
$nestedFile = $zip->getNameIndex($i);
if (pathinfo($nestedFile, PATHINFO_EXTENSION) === 'zip') {
die(xlt('Nested zip files are not allowed'));
}
}
$zip->close();
} else {
die(xlt('Failed to open the zip file'));
}
}

$templatepath = "$templatedir/$form_dest_filename";
Expand Down