mirror/php-tileserver
1
0
Fork 0
mirror of https://github.com/klokantech/tileserver-php.git synced 2025-08-08 07:36:28 +02:00
Code Issues Releases Wiki Activity

Fix security issues - thanks @mheranco (#166)

Browse Source 
* Fix XSS

* Check if requested tile resides inside the current directory

* Add input validation for "renderTile"

* Use floatval instead of "int" for casting
This commit is contained in:
mheranco
2025-07-14 17:08:39 +02:00
committed by GitHub
parent d0fdeaec69
commit 4fe14e6164
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
tileserver.php
View File

@@ -338,6 +338,16 @@ class Server {
* @param string $ext * @param string $ext
*/ */
public function renderTile($tileset, $z, $y, $x, $ext) { public function renderTile($tileset, $z, $y, $x, $ext) {
//simple input validation
$z = floatval($z);
$y = floatval($y);
$x = floatval($x);
$alpharegex = '/^([a-zA-Z0-9-_@\.]*)$/';
if (!preg_match($alpharegex, $tileset) || !preg_match($alpharegex, $ext)) {
header('HTTP/1.1 400 Bad Request');
echo 'Server: Parameter validation failed.';
die;
}
if ($this->isDBLayer($tileset)) { if ($this->isDBLayer($tileset)) {
if ($this->isModified($tileset) == true) { if ($this->isModified($tileset) == true) {
header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Origin: *');
@@ -345,9 +355,6 @@ class Server {
die; die;
} }
$this->DBconnect($this->config['dataRoot'] . $tileset . '.mbtiles'); $this->DBconnect($this->config['dataRoot'] . $tileset . '.mbtiles');
$z = floatval($z);
$y = floatval($y);
$x = floatval($x);
$flip = true; $flip = true;
if ($flip) { if ($flip) {
$y = pow(2, $z) - 1 - $y; $y = pow(2, $z) - 1 - $y;
@@ -383,6 +390,14 @@ class Server {
if($ext != null){ if($ext != null){
$name .= '.' . $ext; $name .= '.' . $ext;
} }
//check if the requested file is inside the current working directory
$requestedPath = realpath($name);
$allowedBasePath = realpath(getcwd());
if (strpos($requestedPath, $allowedBasePath . DIRECTORY_SEPARATOR) !== 0) {
header('HTTP/1.1 404 Not Found');
echo 'Server: Unknown or not specified dataset "' . htmlspecialchars($tileset) . '"';
die;
}
if ($fp = @fopen($name, 'rb')) { if ($fp = @fopen($name, 'rb')) {
if($ext != null){ if($ext != null){
$mime .= $ext; $mime .= $ext;
@@ -406,7 +421,7 @@ class Server {
$this->getCleanTile($meta->scale, $ext); $this->getCleanTile($meta->scale, $ext);
} else { } else {
header('HTTP/1.1 404 Not Found'); header('HTTP/1.1 404 Not Found');
echo 'Server: Unknown or not specified dataset "' . $tileset . '"'; echo 'Server: Unknown or not specified dataset "' . htmlspecialchars($tileset) . '"';
die; die;
} }
} }