Potential Security Issue: MIME Type Spoofing in File Upload Handling

Environment

stable-diffusion-webui-forge Version: 87b0205d87ecb0f338156ded4e5cfce127acffc1 was the latest version I used.

Description

I’ve noticed a potential security vulnerability in the handling of image uploads within the ForgeCanvas component, specifically regarding the LogicalImage class. The issue concerns the validation of image files that are uploaded or processed by the component.

I'm not sure if you perform image validation at any other step, as I am just starting to use your repo and am looking into making extensions with your code base.
I also wanted to know if you have a non-obfuscated version of the canvas JS code, as that would be useful. Alternatively, making it API-like in use could be helpful.
I didn't see any issue guidelines.
I see this primarily as an issue for people who might be hosting a server exposed to the internet. I'm also not sure if this was an issue in the original repo

Issue

The current implementation of the LogicalImage class seems to only check the base64 prefix to determine if a file is a valid PNG image:

if not payload.startswith("data:image/png;base64,"):
    return None

This approach may be inadequate as it only verifies the MIME type based on the base64 string but does not fully validate the actual content of the image. A malicious user could potentially craft a base64 string that passes this check but contains non-image content, leading to potential security risks such as:

MIME Type Spoofing: An attacker could craft a base64 string that mimics the structure of a valid PNG image but contains malicious content.
Oversized or Corrupted Images: Without proper validation of image dimensions or file size, the component might be vulnerable to denial-of-service (DoS) attacks if an oversized or corrupted image is uploaded.

Proposed Solutions

To mitigate these risks, I suggest the following improvements:

Content Verification: Beyond checking the base64 prefix, decode the image and verify its integrity before processing it. For example:

try:
   image_data = base64.b64decode(payload.split(",")[1])

   # File size check (e.g., user-defined limit)
   max_size = 5 * 1024 * 1024  # Default to 5 MB, but should be configurable
   if len(image_data) > max_size:
       return None

   # Open and verify image
   image = Image.open(BytesIO(image_data))
   image.verify()  # Verify image integrity
except Exception as e:
   return None  # Reject the file if verification fails

File Size and Dimension Validation: Implement checks to ensure the file is not excessively large and has reasonable dimensions before processing. It would be beneficial to make the maximum file size limit user-configurable to accommodate different use cases and requirements.
Enhanced Error Handling: Implement robust error handling to manage exceptions that may arise during file processing, ensuring that the application can gracefully handle invalid files.

Impact

Addressing these concerns would enhance the security and robustness of the ForgeCanvas component, reducing the risk of potential exploits related to image processing.

lllyasviel / stable-diffusion-webui-forge