Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Wouter 49 posts 76 karma points
    Sep 02, 2011 @ 14:30
    Wouter
    0

    ImageGen.ashx safety

    Please notice you should check for maximum width and height and path traversal in the ImgeGen.ashx handler. Otherwise it will ne quite easy for a hacker to get your website down:

    [code]

    // Max w+h protection

            if ((int.TryParse(context.Request["height"], out height) && height > 600) || (int.TryParse(context.Request["width"], out width) && width > 800)) {

                return;

            }

     

            // Path traversal check

            var regex = new Regex(@"\.\.+");

            if(regex.IsMatch(context.Request.Url.Query)) {

                return;

            }

    [/code]

  • Douglas Robar 3570 posts 4711 karma points MVP ∞ admin c-trib
    Sep 05, 2011 @ 11:57
    Douglas Robar
    0

    This (and much more) is handled inside the ImageGen.dll code.

    cheers,
    doug. 

  • Wouter 49 posts 76 karma points
    Sep 05, 2011 @ 12:02
    Wouter
    0

    Hey Doug. I don't want to be a pain in the ***. But, are you sure? In a recent website of our company path traversal was possible thourgh ImageGen. You were able to use this to download all files from the umbraco media folder. The width and height story, is there a default max setting for these? Visitors were able to request very large images which made our sever..well..slow. Thanks!

  • Douglas Robar 3570 posts 4711 karma points MVP ∞ admin c-trib
    Sep 05, 2011 @ 12:17
    Douglas Robar
    0

    No worries, thanks for double-checking.

    Both of these enhanced features require ImageGen Pro in order to set any of the following options in the /config/imagegen.config file:

    <MaxWidth>800</MaxWidth>
    <MaxHeight>800</MaxHeight>
    <AllowUpSizing>False</AllowUpSizing>
    <ImageBaseDir>/myPhotosFolder</ImageBaseDir>

    Further checking that a request cannot traverse outside the specified ImageBaseDir has been added to 2.5.4 Beta but I've found a few bugs in its behavior so need to refactor that a bit before releasing it more widely.

    cheers,
    doug. 

  • Wouter 49 posts 76 karma points
    Sep 05, 2011 @ 13:13
    Wouter
    0

    Thank you. We have a couple of ImageGen Pro licenses (tamtam), I read about those features in the documentation. So I will be sure to use those features in the future.

Please Sign in or register to post replies

Write your reply to:

Draft