Fix potential XSS in the preview button of FileWidget #4065

yuki-js · 2024-01-25T09:41:28Z

Reasons for making this change

The value prop in FileWidget parses the data URL inappropriately, which also permits the use of javascript: schema.
When the javascript: schema is set, and ui:filePreview is true, and when the user clicks Preview button, the JavaScript code is evaluated, and then allows XSS attack.

I fixed it by:

parsing the data URL correctly
throwing Error when the URL is invalid
restricting image types from any image to JPEG, PNG, GIF

Checklist

I'm updating documentation
- I've checked the rendering of the Markdown text I've added
I'm adding or updating code
- I've added and/or updated tests. I've run npm run test:update to update snapshots, if needed.
- I've updated docs if needed
- I've updated the changelog with a description of the PR
I'm adding a new feature
- I've updated the playground with an example use of the feature

packages/core/src/components/widgets/FileWidget.tsx

packages/utils/src/dataURItoBlob.ts

heath-freenome · 2024-01-26T20:10:31Z

packages/utils/src/dataURItoBlob.ts

    }
    // Create the blob object
    const blob = new window.Blob([new Uint8Array(array)], { type });

    return { blob, name };
  } catch (error) {
-    return { blob: { size: 0, type: (error as Error).message }, name: dataURI };
+    throw new Error('File is invalid: failed to decode base64');


Why not just treat all of the errors to return a blob like these?

The original code treated the invalid file as zero-sized file. Of course, the invalid file is different from the zero-sized valid file. Invalid files should have been taken care of by the callee, but actually it was not.
This behavior also allowed javascript: schema.
I fixed this by handling these errors correctly.

heath-freenome · 2024-01-26T20:13:29Z

@yuki-js your build in @rjsf/utils is failing.

yuki-js · 2024-01-27T05:32:04Z

@heath-freenome Thank you for your review.
This failure is the same as the one we faced previously. Could you rerun it?
https://github.com/rjsf-team/react-jsonschema-form/actions/runs/7474848380/attempts/3
I'm sorry it was my oversight.

to pass the coverage test

heath-freenome

Sorry, I forgot to submit these comments over the weekend

packages/core/src/components/widgets/FileWidget.tsx

heath-freenome · 2024-01-28T19:25:11Z

packages/core/src/components/widgets/FileWidget.tsx

+        },
+      ];
+    } catch (e) {
+      // Invalid dataURI, so just ignore it.


Maybe we want to report the exception to the user? Or make the file upload report it so that they don't wonder why their file disappeared

Possibility of Exception: When the ordinary user uploads files in ordinary way, the exception should never happen, since the data URL is always returned, and Base64 encoding/decoding always be successful. Therefore the data should not disappear in an unintuitive way.

Error notification: If the caller injects the malformed string into formData, validator rejects it with .files.0 must match format "data-url", but it would be an issue on the side of the caller.

Although I could also change it by adding error flag in FileInfoType, I decided not to notify the explicit error for this reason.

Co-authored-by: Heath C <51679588+heath-freenome@users.noreply.github.com>

Co-authored-by: Heath C <51679588+heath-freenome@users.noreply.github.com> Co-authored-by: Abdallah Al-Soqatri <abdallah.al-soqatri@aspentech.com> Co-authored-by: Kevin Burnett <18027+burnettk@users.noreply.github.com> Co-authored-by: Marek Bodinger <marek.bodinger@gmail.com> Co-authored-by: Mehdi Salem <mehdi.salem@qt.io> Co-authored-by: Jonasz Wiącek <jonaszwiacek@gmail.com> Co-authored-by: Bogdan Savluk <savluk.bogdan@gmail.com> Co-authored-by: Christian Wendt <54559756+cwendtxealth@users.noreply.github.com> Co-authored-by: Ben Lambert <ben@blam.sh> Co-authored-by: David R. Bild <david@davidbild.org> Co-authored-by: Ariqun <38001928+Ariqun@users.noreply.github.com> Co-authored-by: Shivam Anand Murmu <35562703+Rozamo@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Shubham Biswas <46351104+Shubhcoder@users.noreply.github.com> Co-authored-by: popmanhe <neo_temp@hotmail.com> Co-authored-by: Yuki Aoki <me@aoki.app> Co-authored-by: Xiangcheng Kuo <37873394+orange-guo@users.noreply.github.com> Co-authored-by: Bart van Andel <bavanandel@gmail.com> Co-authored-by: Laurent Direr <laurent.direr@gmail.com> Co-authored-by: Vegard Stenvik <42935080+vstenvik@users.noreply.github.com> Co-authored-by: Appie <abdallarko@hotmail.com> Co-authored-by: Oren Forer <oforer@gmail.com> Co-authored-by: Marcus Penn <11893741+mpenndev@users.noreply.github.com> Co-authored-by: joachimhagheim <47362824+joachimhagheim@users.noreply.github.com> Co-authored-by: MarekBodingerBA <104828482+MarekBodingerBA@users.noreply.github.com> Co-authored-by: momesana <momesana@gmail.com> Co-authored-by: Martti Roitto <MarttiR@users.noreply.github.com> fix(utils): direct lodash function import to improve bundling on library client side (#3976) fix: #3961 resolve all recurse list for object properties (#3981) fix gap in outline when label is hidden (#3984) Fix: Expose the internal `ajv` variable in the validator implementation classes (#3991) Fixes: #3972 indirectly by exposing the `ajv` variable for use in the issue Fix: Change FormHelperText usage with @mui/material to render divs (#4032) Fixes #4031 by switching the render component for `FormHelperText` to be `div` fix: Added support for anyOf/oneOf in uiSchema (#4055) Fixes #4039 by updating `MultiSchemaField` to properly support `anyOf`/`oneOf` arrays in the `uiSchema` Fix checkbox with 0 as a value was unselectable in antd (#4068) Fixed #4067 by properly dealing with enums that have 0 as a value Fix potential XSS in the preview button of FileWidget (#4065) Fix: Make 'ui:rows' option work with chakra-ui for textarea elements #4070 (#4078) Fix typo in ErrorsListTemplate example (#4087) Fix #4080 by moving `base64` encoder/decoder from `@rjsf/utils` to playground (#4093) Fix: Error state not resetting when schema changes (#4079) (#4103) Fix noImplicitAny error (#4106) Fixes: [WARNING] Duplicate key "include" in object literal [duplicate-object-key] (#4114) Fixes: Warning: validateDOMNesting(...): <p> cannot appear as a descendant of <p>. (#4117) Fix documentation to add missing Form imports (#4131) Fix #4127 to add missing `Form` import in documentation Fix: filename should be bold (#4125) Fix: use correct ConfigProvider context by using named imports (#4132) Fix 4134 by filtering out bad DOM props (#4140) Fixes: #4134 by updating the spreading of props onto the `TextField` to remove bad DOM fields Fixed Programmatic submit not working properly in Firefox (#4150) Fix Maximum call stack size exceeded in findSchemaDefinition (#4123)

Co-authored-by: Heath C <51679588+heath-freenome@users.noreply.github.com> Co-authored-by: Abdallah Al-Soqatri <abdallah.al-soqatri@aspentech.com> Co-authored-by: Kevin Burnett <18027+burnettk@users.noreply.github.com> Co-authored-by: Marek Bodinger <marek.bodinger@gmail.com> Co-authored-by: Mehdi Salem <mehdi.salem@qt.io> Co-authored-by: Nick Grosenbacher <nickgrosenbacher@gmail.com> Co-authored-by: Abdallah Al-Soqatri <abdallah.al-soqatri@inmation.com> Co-authored-by: Jonasz Wiącek <jonaszwiacek@gmail.com> Co-authored-by: Bogdan Savluk <savluk.bogdan@gmail.com> Co-authored-by: Christian Wendt <54559756+cwendtxealth@users.noreply.github.com> Co-authored-by: Ben Lambert <ben@blam.sh> Co-authored-by: David R. Bild <david@davidbild.org> Co-authored-by: Ariqun <38001928+Ariqun@users.noreply.github.com> Co-authored-by: Shivam Anand Murmu <35562703+Rozamo@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Shubham Biswas <46351104+Shubhcoder@users.noreply.github.com> Co-authored-by: popmanhe <neo_temp@hotmail.com> Co-authored-by: Yuki Aoki <me@aoki.app> Co-authored-by: Xiangcheng Kuo <37873394+orange-guo@users.noreply.github.com> Co-authored-by: Bart van Andel <bavanandel@gmail.com> Co-authored-by: Laurent Direr <laurent.direr@gmail.com> Co-authored-by: Vegard Stenvik <42935080+vstenvik@users.noreply.github.com> Co-authored-by: Appie <abdallarko@hotmail.com> Co-authored-by: Oren Forer <oforer@gmail.com> Co-authored-by: Marcus Penn <11893741+mpenndev@users.noreply.github.com> Co-authored-by: joachimhagheim <47362824+joachimhagheim@users.noreply.github.com> Co-authored-by: MarekBodingerBA <104828482+MarekBodingerBA@users.noreply.github.com> Co-authored-by: momesana <momesana@gmail.com> Co-authored-by: Martti Roitto <MarttiR@users.noreply.github.com> Co-authored-by: Serge van den Oever <serge@macaw.nl> Co-authored-by: Enzo Ferey <hello@enzoferey.com> Co-authored-by: Skyf0l <tom.rorato@gmail.com> Co-authored-by: Jaejoon Han <jj2726@gmail.com> Co-authored-by: とまとみ <tomatommy.bs@gmail.com> Co-authored-by: Daniel Todd <todddaniel@gmail.com> Co-authored-by: Dmitry Dzhus <dima@dzhus.org> Co-authored-by: Alexander Kachkaev <alexander@kachkaev.ru> Co-authored-by: shaddollxz <56341682+shaddollxz@users.noreply.github.com> Co-authored-by: Changyu Geng <gcyyq@hotmail.com> Co-authored-by: Helen Lin <46795546+helen-m-lin@users.noreply.github.com> Co-authored-by: solimant <solimant@users.noreply.github.com> Co-authored-by: David Li <davidli@cs.stanford.edu> fix(utils): direct lodash function import to improve bundling on library client side (#3976) fix: #3961 resolve all recurse list for object properties (#3981) fix gap in outline when label is hidden (#3984) Fix: Expose the internal `ajv` variable in the validator implementation classes (#3991) Fixes: #3972 indirectly by exposing the `ajv` variable for use in the issue Fix: Change FormHelperText usage with @mui/material to render divs (#4032) Fixes #4031 by switching the render component for `FormHelperText` to be `div` fix: Added support for anyOf/oneOf in uiSchema (#4055) Fixes #4039 by updating `MultiSchemaField` to properly support `anyOf`/`oneOf` arrays in the `uiSchema` Fix checkbox with 0 as a value was unselectable in antd (#4068) Fixed #4067 by properly dealing with enums that have 0 as a value Fix potential XSS in the preview button of FileWidget (#4065) Fix: Make 'ui:rows' option work with chakra-ui for textarea elements #4070 (#4078) Fix typo in ErrorsListTemplate example (#4087) Fix #4080 by moving `base64` encoder/decoder from `@rjsf/utils` to playground (#4093) Fix: Error state not resetting when schema changes (#4079) (#4103) Fix noImplicitAny error (#4106) Fixes: [WARNING] Duplicate key "include" in object literal [duplicate-object-key] (#4114) Fixes: Warning: validateDOMNesting(...): <p> cannot appear as a descendant of <p>. (#4117) Fix documentation to add missing Form imports (#4131) Fix #4127 to add missing `Form` import in documentation Fix: filename should be bold (#4125) Fix: use correct ConfigProvider context by using named imports (#4132) Fix 4134 by filtering out bad DOM props (#4140) Fixes: #4134 by updating the spreading of props onto the `TextField` to remove bad DOM fields Fixed Programmatic submit not working properly in Firefox (#4150) Fix Maximum call stack size exceeded in findSchemaDefinition (#4123) fix typos in constants.ts, Form.tsx (#4185) Fix mui imports in docs (#4218) fix] Resetting number fields should check the entire string when deciding to leave the input text alone (#4202) (#4220) Fixed performance issue with large schema dependencies and oneOf (#4203) (#4204) Fixed performance issue #4203 fix(core): field ui-options higher priority (#4212) fix(antd): disabled property of options of antd theme (#4216) fix: omitExtraData on submit and on validateForm (#4228) Fix IdSchema and PathSchema types (#4196) fixes #4236 Fix #4197 in various themes by showing empty option in SelectWidget when appropriate (#4200) fix: xss when rendering schema errors (#4256) fix 4215 and 4260 by updating optionsList() to take a uiSchema (#4263) Fixes #4215 and #4260 by supporting alternate titles for enums and anyOf/oneOf lists via the uiSchema Fixed Changelog (#4269)

yuki-js added 4 commits January 25, 2024 18:20

fix dataURI parsing mechanism

0a6ff5f

Restrict image preview file types

ba6b83d

Make broken files be ignored

bacca35

Update changelog

b057955

heath-freenome reviewed Jan 26, 2024

View reviewed changes

Refactor image preview whitelist, add comments, and fix tests

5d744bd

yuki-js requested a review from heath-freenome January 27, 2024 05:32

fix the way of error handling

16e1bde

to pass the coverage test

heath-freenome reviewed Jan 29, 2024

View reviewed changes

yuki-js and others added 2 commits January 30, 2024 15:18

Update packages/core/src/components/widgets/FileWidget.tsx

c4ae809

Co-authored-by: Heath C <51679588+heath-freenome@users.noreply.github.com>

Merge branch 'main' into fix/file-xss

da3f5a1

heath-freenome approved these changes Jan 30, 2024

View reviewed changes

heath-freenome merged commit ee2ac9b into rjsf-team:main Jan 30, 2024
4 checks passed

yuki-js deleted the fix/file-xss branch January 30, 2024 16:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix potential XSS in the preview button of FileWidget #4065

Fix potential XSS in the preview button of FileWidget #4065

yuki-js commented Jan 25, 2024 •

edited

Loading

heath-freenome Jan 26, 2024

yuki-js Jan 27, 2024 •

edited

Loading

heath-freenome commented Jan 26, 2024

yuki-js commented Jan 27, 2024 •

edited

Loading

heath-freenome left a comment

heath-freenome Jan 28, 2024

yuki-js Jan 30, 2024

Fix potential XSS in the preview button of FileWidget #4065

Fix potential XSS in the preview button of FileWidget #4065

Conversation

yuki-js commented Jan 25, 2024 • edited Loading

Reasons for making this change

Checklist

heath-freenome Jan 26, 2024

Choose a reason for hiding this comment

yuki-js Jan 27, 2024 • edited Loading

Choose a reason for hiding this comment

heath-freenome commented Jan 26, 2024

yuki-js commented Jan 27, 2024 • edited Loading

heath-freenome left a comment

Choose a reason for hiding this comment

heath-freenome Jan 28, 2024

Choose a reason for hiding this comment

yuki-js Jan 30, 2024

Choose a reason for hiding this comment

yuki-js commented Jan 25, 2024 •

edited

Loading

yuki-js Jan 27, 2024 •

edited

Loading

yuki-js commented Jan 27, 2024 •

edited

Loading