@a_5mith, depending on the attack vector even an image file could be dangerous if containing some malicious bash script which could potentially be executed.
Just another reason an imgur auto-upload plugin is awesome - the image is passed through api straight to imgur, so on access it runs from their servers, not your own.
Can we do filtering for uploads to restrict/allow certain file extensions? We could use this format: jpg|gif|png|txt|pdf as allowed, and everything else is restricted. You'd have to explicitly add the extensions you want to allow in an input box in the ACP.
@julian said:
I'll say it first -- I hate local uploads. It's really hard to do them right. This is why NodeBB supported only gravatars and imgur uploads up until fairly recently...
It's nearly impossible to have a completely secure platform with local uploads. Your aversion of them is wise, and well respected.
@trevor Extension spoofing could still be an issue, or as I previously mentioned the inclusion of malicious bash scripting.
@Ted said:
@trevor Extension spoofing could still be an issue, or as I previously mentioned the inclusion of malicious bash scripting.
I was aware of this a while back, which is why I've disabled file uploads on my site until the team can get some further security discussions such as this one initiated to find the best solution to deal with these types of issues.
@trevor Remote uploads only seems to be the best option. Though you miss out if a service goes down. To imgur's credit, it doesn't break for long on the rare occasion it does.
@Ted In my use case, the only reason I'd have them uploaded on the server is for manipulation - for a bit more quality, better upscaling and some other things.
This is still working pretty well to upload basically any fileype. This on a git clone from last night.
Having "Allow users to upload regular files"(having no effect turning this on or off) unchecked and using the upload image from the imgur plugin as the uploader. It only gets uploaded to imgur if it's a .jpg file, all else gets uploaded locally.
Also, .png files gets uploaded locally as well, but afterwards the url isn't replaced, but it says (uploaded 100%) after the filename.
Above works the same here on this nodebb installation.
examples below:
output.log
Just fixed a bunch of checks for local uploads in https://github.com/NodeBB/NodeBB/commit/61f7f0f8890f2fee404fb4fac77d627b4c184489. You shouldn't be able to upload locally now if the setting is turned off. As for png images not going to imgur I couldn't reproduce that.
