diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/Jellyfin.Drawing.Skia/SkiaEncoder.cs | 20 | ||||
| -rw-r--r-- | src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs | 304 |
2 files changed, 324 insertions, 0 deletions
diff --git a/src/Jellyfin.Drawing.Skia/SkiaEncoder.cs b/src/Jellyfin.Drawing.Skia/SkiaEncoder.cs index b6d2914efa..64329feabd 100644 --- a/src/Jellyfin.Drawing.Skia/SkiaEncoder.cs +++ b/src/Jellyfin.Drawing.Skia/SkiaEncoder.cs @@ -11,6 +11,7 @@ using MediaBrowser.Controller.Drawing; using MediaBrowser.Model.Drawing; using Microsoft.Extensions.Logging; using SkiaSharp; +using Svg; using Svg.Skia; namespace Jellyfin.Drawing.Skia; @@ -48,6 +49,13 @@ public class SkiaEncoder : IImageEncoder /// </summary> public static readonly SKSamplingOptions DefaultSamplingOptions = new SKSamplingOptions(SKFilterMode.Linear, SKMipmapMode.Linear); + static SkiaEncoder() + { + SvgDocument.ResolveExternalElements = ExternalType.None; + SvgDocument.ResolveExternalImages = ExternalType.None; + SvgDocument.ResolveExternalXmlEntites = ExternalType.None; + } + /// <summary> /// Initializes a new instance of the <see cref="SkiaEncoder"/> class. /// </summary> @@ -183,6 +191,12 @@ public class SkiaEncoder : IImageEncoder var extension = Path.GetExtension(path.AsSpan()); if (extension.Equals(".svg", StringComparison.OrdinalIgnoreCase)) { + if (!SvgSecurityValidator.IsSafe(path, _logger)) + { + _logger.LogError("Refusing to determine dimensions for SVG with external references {FilePath}", path); + return default; + } + using var svg = new SKSvg(); try { @@ -445,6 +459,12 @@ public class SkiaEncoder : IImageEncoder throw new FileNotFoundException("File not found", path); } + if (!SvgSecurityValidator.IsSafe(path, _logger)) + { + _logger.LogError("Refusing to render SVG with external references {FilePath}", path); + return null; + } + using var svg = SKSvg.CreateFromFile(path); if (svg.Drawable is null) { diff --git a/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs b/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs new file mode 100644 index 0000000000..354c761eeb --- /dev/null +++ b/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs @@ -0,0 +1,304 @@ +using System; +using System.IO; +using System.IO.Compression; +using System.Runtime.CompilerServices; +using System.Text; +using System.Xml; +using Microsoft.Extensions.Logging; + +[assembly: InternalsVisibleTo("Jellyfin.Drawing.Skia.Tests")] + +namespace Jellyfin.Drawing.Skia; + +/// <summary> +/// Validates that an SVG document does not reference external resources before it is rasterized. +/// </summary> +internal static class SvgSecurityValidator +{ + // Guards against a chain of nested data:image/svg+xml payloads. + private const int MaxDataUriDepth = 4; + + // Upper bound for a decompressed svgz payload carried inside a data URI, to guard against decompression bombs. + private const int MaxDecompressedBytes = 16 * 1024 * 1024; + + private static readonly XmlReaderSettings _scanSettings = new() + { + DtdProcessing = DtdProcessing.Parse, + XmlResolver = null, + MaxCharactersFromEntities = 1024 * 1024, + IgnoreComments = true, + IgnoreProcessingInstructions = true, + IgnoreWhitespace = true, + CloseInput = false + }; + + /// <summary> + /// Determines whether the SVG at the given path is safe to rasterize, i.e. contains no references + /// to external resources. + /// </summary> + /// <param name="path">The path to the SVG file.</param> + /// <param name="logger">The logger.</param> + /// <returns><c>true</c> if the document is free of external references; otherwise <c>false</c>.</returns> + public static bool IsSafe(string path, ILogger logger) + { + try + { + using var stream = File.OpenRead(path); + return IsSafe(stream, logger); + } + catch (IOException ex) + { + logger.LogWarning(ex, "Unable to read SVG {Path} for validation, refusing to render", path); + return false; + } + catch (UnauthorizedAccessException ex) + { + logger.LogWarning(ex, "Unable to read SVG {Path} for validation, refusing to render", path); + return false; + } + } + + /// <summary> + /// Determines whether the SVG in the given stream is safe to rasterize. + /// </summary> + /// <param name="stream">The stream containing the SVG document.</param> + /// <param name="logger">The logger.</param> + /// <returns><c>true</c> if the document is free of external references; otherwise <c>false</c>.</returns> + public static bool IsSafe(Stream stream, ILogger logger) + => IsSafe(stream, logger, 0); + + private static bool IsSafe(Stream stream, ILogger logger, int depth) + { + try + { + using var reader = XmlReader.Create(stream, _scanSettings); + while (reader.Read()) + { + switch (reader.NodeType) + { + case XmlNodeType.DocumentType: + var subset = reader.Value; + if (!string.IsNullOrEmpty(subset) + && (subset.Contains("SYSTEM", StringComparison.OrdinalIgnoreCase) + || subset.Contains("PUBLIC", StringComparison.OrdinalIgnoreCase))) + { + logger.LogWarning("Refusing to render SVG declaring an external DTD entity"); + return false; + } + + break; + + case XmlNodeType.Element when reader.HasAttributes: + for (var i = 0; i < reader.AttributeCount; i++) + { + reader.MoveToAttribute(i); + var value = reader.Value; + if (reader.LocalName.Equals("href", StringComparison.OrdinalIgnoreCase)) + { + if (!IsReferenceSafe(value, logger, depth)) + { + logger.LogWarning("Refusing to render SVG referencing external resource via href"); + return false; + } + } + else if (HasUnsafeCssReference(value, logger, depth)) + { + logger.LogWarning("Refusing to render SVG referencing external resource via style/url()"); + return false; + } + } + + reader.MoveToElement(); + break; + + case XmlNodeType.Text: + case XmlNodeType.CDATA: + if (HasUnsafeCssReference(reader.Value, logger, depth)) + { + logger.LogWarning("Refusing to render SVG referencing external resource in style block"); + return false; + } + + break; + } + } + + return true; + } + catch (XmlException ex) + { + // Malformed markup, a forbidden DTD construct or an unresolved external entity: refuse to render. + logger.LogWarning(ex, "Refusing to render SVG that could not be safely parsed"); + return false; + } + } + + private static bool IsReferenceSafe(string? value, ILogger logger, int depth) + { + if (string.IsNullOrEmpty(value)) + { + return true; + } + + var trimmed = value.Trim(); + if (trimmed.Length == 0 || trimmed[0] == '#') + { + return true; + } + + if (trimmed.StartsWith("data:", StringComparison.OrdinalIgnoreCase)) + { + return IsDataUriSafe(trimmed, logger, depth); + } + + return false; + } + + private static bool IsDataUriSafe(string dataUri, ILogger logger, int depth) + { + // "data:[<mediatype>][;base64],<payload>" (mirrors Svg.Model's data URI parsing). + var comma = dataUri.IndexOf(',', StringComparison.Ordinal); + if (comma < 0) + { + return false; + } + + var header = dataUri[5..comma]; + var segments = header.Split(';'); + var mediaType = segments.Length > 0 && segments[0].Contains('/', StringComparison.Ordinal) + ? segments[0].Trim() + : "text/plain"; + + // Only "image/svg+xml" is re-parsed as SVG by the renderer; any other type is treated as raster data. + if (!mediaType.Equals("image/svg+xml", StringComparison.OrdinalIgnoreCase)) + { + return true; + } + + if (depth >= MaxDataUriDepth) + { + logger.LogWarning("Refusing to render SVG with nested data URIs exceeding the allowed depth"); + return false; + } + + var isBase64 = segments.Length > 0 && segments[^1].Trim().Equals("base64", StringComparison.OrdinalIgnoreCase); + try + { + var payload = dataUri[(comma + 1)..]; + byte[] bytes = isBase64 + ? Convert.FromBase64String(payload.Trim()) + : Encoding.UTF8.GetBytes(Uri.UnescapeDataString(payload)); + + if (bytes.Length > 2 && bytes[0] == 0x1F && bytes[1] == 0x8B) + { + bytes = Decompress(bytes); + } + + using var ms = new MemoryStream(bytes, false); + return IsSafe(ms, logger, depth + 1); + } + catch (FormatException ex) + { + logger.LogWarning(ex, "Refusing to render SVG with an undecodable data URI"); + return false; + } + catch (InvalidDataException ex) + { + logger.LogWarning(ex, "Refusing to render SVG with an invalid compressed data URI"); + return false; + } + } + + private static byte[] Decompress(byte[] compressed) + { + using var input = new MemoryStream(compressed, false); + using var gzip = new GZipStream(input, CompressionMode.Decompress); + using var output = new MemoryStream(); + var buffer = new byte[81920]; + var total = 0; + int read; + while ((read = gzip.Read(buffer, 0, buffer.Length)) > 0) + { + total += read; + if (total > MaxDecompressedBytes) + { + throw new InvalidDataException("Compressed data URI exceeds the allowed size"); + } + + output.Write(buffer, 0, read); + } + + return output.ToArray(); + } + + private static bool HasUnsafeCssReference(string? value, ILogger logger, int depth) + { + if (string.IsNullOrEmpty(value)) + { + return false; + } + + var span = value.AsSpan(); + var index = 0; + while (true) + { + var found = span[index..].IndexOf("url(", StringComparison.OrdinalIgnoreCase); + if (found < 0) + { + break; + } + + var start = index + found + 4; + var close = span[start..].IndexOf(')'); + if (close < 0) + { + break; + } + + var target = span.Slice(start, close).Trim(); + target = target.Trim('\''); + target = target.Trim('"').Trim(); + if (!IsReferenceSafe(target.ToString(), logger, depth)) + { + return true; + } + + index = start + close + 1; + if (index >= span.Length) + { + break; + } + } + + // Handle the bare "@import '...';" form (the "@import url(...)" form is covered above). + index = 0; + while (true) + { + var found = span[index..].IndexOf("@import", StringComparison.OrdinalIgnoreCase); + if (found < 0) + { + break; + } + + var rest = span[(index + found + 7)..]; + var quote = rest.IndexOfAny('\'', '"'); + if (quote >= 0) + { + var afterQuote = rest[(quote + 1)..]; + var end = afterQuote.IndexOfAny('\'', '"'); + if (end >= 0 && !IsReferenceSafe(afterQuote[..end].Trim().ToString(), logger, depth)) + { + return true; + } + } + + index = index + found + 7; + if (index >= span.Length) + { + break; + } + } + + return false; + } +} |