search

pushtype / push_type

PushType is a modern, open source content management system for Ruby on Rails.
http://www.pushtype.org
Other
290 stars 32 forks source link

Dragonfly possible injection attack #40

Open aaronrussell opened 7 years ago

aaronrussell commented 7 years ago

The bug tracker on one of our sites is being flooded with requests similar to:

/media/image_path.jpg?style=245x320# UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- ggwd

Resulting in params:

{
  "style": "245x320# UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- ggwd"
}

And is raising an error:

ArgumentError·Didn't recognise the geometry string 245x320# UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- ggwd

I don't think there's an actual security risk here, but would be nice to have someone else review the code. Additionally maybe the style regex can extract the intended parameter more strictly and ignore the rest.