-1

I have a module that uses the Fields API to insert a HTML5 canvas element and allows users to define paths to user scripts to be loaded with the page:

enter image description here

The scripts are relative to a hard-coded path base_path() . 'sites/all/libraries' . $field_value . '.js' so users will have to put all their scripts in the libraries folder.

Is this a safe way to implement this? Does it have and security vulnerabilities?

  • Wait, you already let users to edit your site's libraries folder? – Mołot Dec 15 '14 at 14:00
  • have you at least disabled PHP in libraries? – Mołot Dec 15 '14 at 14:09
  • yes - the users being me and other trusted. Leads on from my former question drupal.stackexchange.com/questions/138519/…. I was advised it might be dangerous thing to do. – RobotEyes Dec 15 '14 at 14:09
  • 1
    If users are so trusted you let them write in your server's directories, and execute their arbitrary code, why should you care about field's settings? You know, they can put their own php file there and became admins themselves, they can put custom php and overwrite any file they wish, they can do anything they want to your site, without even using these fields. Including removing any limits you put on these fields. So why would you even bother? – Mołot Dec 15 '14 at 14:13
  • Thanks Molot. It's for productivity. Its faster to have this field to insert canvas and scripts in one go. – RobotEyes Dec 15 '14 at 14:17
3

I'm not sure you'll get a much different answer here than you did in your previous question...

But anyhow, assuming your module properly sanitizes the input of the script paths field, it's still potentially dangerous to the extent that:

  • your users could be untrustworthy, and
  • your users could add arbitrary scripts to the file system

I can't tell from this question or the original if you mean that users will be adding a unique javascript file for each bit of content, or only that they get to choose one among several scripts to add. If they're adding new javascript files, add to the risk above:

  • your users may not be able to write safe scripts

So for the most part, this boils down to an issue of trust, so long as the architecture is as described.

To deal with the first item first, it's possible to deny roles upload privileges, so you can prevent them uploading anything or everything if you prefer.

For the second point, the key word is "arbitrary". Drupal has a hook, hook_library that allows you to define js libraries that can be added and referred to from code. You could use this hook to define a preset collection of libraries that your users could add to individual pages (if, as I mentioned, you only need to offer a choice of libraries, and not unique libraries per page).


But I'd suggest rethinking the architecture. For example, if users need to add a unique script to each node, I'd wonder if it would be possible to abstract out what is common to each script, load that script on every relevant page automatically, and let the users pass configuration options through the form fields instead (or e.g. even upload a json or other structured data file which could be sanitized/sanity-checked in PHP before being output to the page).

Alternatively, if you just need to offer your users the option of one among several libraries, and you already use the Context module, you could use a module like e.g. RE Context Libraries to add js files to individual nodes (disclaimer: I wrote the module).

This would allow you to restrict the insertion of libraries to those you've pre-approved, as well as allowing you to piggy-back on the Context module's permissions (though I'd note that the Context module's permissions may not be fine-grained enough if you have many users).

  • thanks, I think you're right that the architecture probably needs a rethink. The module is for data visualisation on canvas. When the field is included in a content type the canvas element is included and the required javascripts are also included. Each canvas element has it's own js file which can be totally unique. I can do it the long way round but it would be nice to have it in a form to quickly add the visualisations to a post. – RobotEyes Dec 15 '14 at 14:45
2

It's only as safe as your users wants it to be

You allowed your users to put files on your server, in a folder where Drupal keeps files meant to be executed. It means that:

If you allow PHP in libraries

any of them can do anything with your site whenever he wants.

If PHP files placed in libraries are blocked

it still does not really matter what paths you allow in fields. Their JS files will be able to do pretty much anything they want anyway. This includes ability to unknowingly introduce XSS options for third-parties even if they didn't mean it.

Safer way

would be to do what Stack Exchange is doing. You can read about it in Introducing Runnable JavaScript, CSS, and HTML Code Snippets. Main points are:

  • We use HTML5 sandboxed iframes in order to prevent many forms of malicious attack.
  • We render the Snippets on an external domain (stacksnippets.net) in order to ensure that the same-origin policy is not in effect and to keep the snippets from accessing your logged-in session or cookies.

And of course they will not allow anyone to write to the folder that keeps site's own files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.