Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(SmartNTT): support new file name for sponsored images #994

Closed
wants to merge 1 commit into from
Closed

feat(SmartNTT): support new file name for sponsored images #994

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions lib/ntpUtil.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ const isValidSchemaVersion = (version) => {
return version === jsonSchemaVersion
}

const prepareAssets = (jsonFileUrl, targetResourceDir, targetJsonFileName) => {
const prepareAssets = (jsonFileUrl, targetResourceDir, targetJsonFileName = 'photo.json') => {
return new Promise(function (resolve, reject) {
let jsonFileBody = '{}'

Expand Down Expand Up @@ -126,7 +126,7 @@ const prepareAssets = (jsonFileUrl, targetResourceDir, targetJsonFileName) => {
return reject(error)
}

createPhotoJsonFile(path.join(targetResourceDir, 'photo.json'), JSON.stringify(photoData))
createPhotoJsonFile(path.join(targetResourceDir, targetJsonFileName), JSON.stringify(photoData))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Source: https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal


Cc @thypon @kdenhartog

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems like it could be an issue on first glance without knowing how this is called everywhere. As a quick and simple fix we could validate that the targetJsonFileNames and targetResourceDir are values we expect within this function to be certain we're not introducing a path traversal vulnerability.

The issue I'm thinking might be possible (but will require further digging in how this code works) is that a sponsored image is named in a particular way such that it could load an unexpected image (and count it as viewing a sponsored image) or potentially overwrite a file on disk. I'm not certain this is possible at the moment, but have you considered this and handled it else where?


// Download image files that specified in jsonFileUrl
const imageFileNameList = getImageFileNameListFrom(photoData)
Expand Down
8 changes: 6 additions & 2 deletions scripts/ntp-sponsored-images/generate.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,12 @@ async function generateNTPSponsoredImages (dataUrl, targetComponents) {
const targetResourceDir = path.join(rootResourceDir, regionPlatformName)
mkdirp.sync(targetResourceDir)
const regionPlatformPath = regionPlatformName.replace('-', '/')
const sourceJsonFileUrl = `${dataUrl}${regionPlatformPath}/photo.json`
await ntpUtil.prepareAssets(sourceJsonFileUrl, targetResourceDir)
const baseJsonFileUrl = `${dataUrl}${regionPlatformPath}`

await Promise.all([
ntpUtil.prepareAssets(`${baseJsonFileUrl}/photo.json`, targetResourceDir),
ntpUtil.prepareAssets(`${baseJsonFileUrl}/si-photo.json`, targetResourceDir, 'si-photo.json')
])
}
}

Expand Down
Loading