Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #3057314 by alexpott, chr.fritsch, larowlan: Harden hash checking in core

merge-requests/1119/head
Lee Rowlands 2019-06-05 09:13:24 +10:00
parent 20496dd2e7
commit cf939a5dc0
No known key found for this signature in database
GPG Key ID: 2B829A3DF9204DC4
4 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/includes/bootstrap.inc
View File

@ -679,7 +679,7 @@ function drupal_valid_test_ua($new_prefix = NULL) {
$test_hmac = Crypt::hmacBase64($check_string, $key); $test_hmac = Crypt::hmacBase64($check_string, $key);
// Since we are making a local request a 600 second time window is allowed, // Since we are making a local request a 600 second time window is allowed,
// and the HMAC must match. // and the HMAC must match.
if ($time_diff >= 0 && $time_diff <= 600 && $hmac === $test_hmac) { if ($time_diff >= 0 && $time_diff <= 600 && Crypt::hashEquals($test_hmac, $hmac)) {
$test_prefix = $prefix; $test_prefix = $prefix;
} }
else { else {

3
core/modules/file/src/Element/ManagedFile.php
View File

@ -110,7 +110,8 @@ class ManagedFile extends FormElement {
// token added by $this->processManagedFile(). // token added by $this->processManagedFile().
elseif (\Drupal::currentUser()->isAnonymous()) { elseif (\Drupal::currentUser()->isAnonymous()) {
$token = NestedArray::getValue($form_state->getUserInput(), array_merge($element['#parents'], ['file_' . $file->id(), 'fid_token'])); $token = NestedArray::getValue($form_state->getUserInput(), array_merge($element['#parents'], ['file_' . $file->id(), 'fid_token']));
if ($token !== Crypt::hmacBase64('file-' . $file->id(), \Drupal::service('private_key')->get() . Settings::getHashSalt())) { $file_hmac = Crypt::hmacBase64('file-' . $file->id(), \Drupal::service('private_key')->get() . Settings::getHashSalt());
if ($token === NULL || !Crypt::hashEquals($file_hmac, $token)) {
$force_default = TRUE; $force_default = TRUE;
break; break;
} }

2
core/modules/image/src/Controller/ImageStyleDownloadController.php
View File

@ -109,7 +109,7 @@ class ImageStyleDownloadController extends FileDownloadController {
// starts with styles/. // starts with styles/.
$valid = !empty($image_style) && $this->streamWrapperManager->isValidScheme($scheme); $valid = !empty($image_style) && $this->streamWrapperManager->isValidScheme($scheme);
if (!$this->config('image.settings')->get('allow_insecure_derivatives') || strpos(ltrim($target, '\/'), 'styles/') === 0) { if (!$this->config('image.settings')->get('allow_insecure_derivatives') || strpos(ltrim($target, '\/'), 'styles/') === 0) {
$valid &= $request->query->get(IMAGE_DERIVATIVE_TOKEN) === $image_style->getPathToken($image_uri); $valid &= Crypt::hashEquals($image_style->getPathToken($image_uri), $request->query->get(IMAGE_DERIVATIVE_TOKEN, ''));
} }
if (!$valid) { if (!$valid) {
// Return a 404 (Page Not Found) rather than a 403 (Access Denied) as the // Return a 404 (Page Not Found) rather than a 403 (Access Denied) as the

2
core/modules/system/src/Controller/EntityAutocompleteController.php
View File

@ -87,7 +87,7 @@ class EntityAutocompleteController extends ControllerBase {
$selection_settings = $this->keyValue->get($selection_settings_key, FALSE); $selection_settings = $this->keyValue->get($selection_settings_key, FALSE);
if ($selection_settings !== FALSE) { if ($selection_settings !== FALSE) {
$selection_settings_hash = Crypt::hmacBase64(serialize($selection_settings) . $target_type . $selection_handler, Settings::getHashSalt()); $selection_settings_hash = Crypt::hmacBase64(serialize($selection_settings) . $target_type . $selection_handler, Settings::getHashSalt());
if ($selection_settings_hash !== $selection_settings_key) { if (!Crypt::hashEquals($selection_settings_hash, $selection_settings_key)) {
// Disallow access when the selection settings hash does not match the // Disallow access when the selection settings hash does not match the
// passed-in key. // passed-in key.
throw new AccessDeniedHttpException('Invalid selection settings key.'); throw new AccessDeniedHttpException('Invalid selection settings key.');