in reply to

Two weeks ago I wrote that I hacked my own site. I think it’s important to share how I did it, to make people more aware of possible vulnerabilities, so they can find them too. If others didn’t write about their findings, I wouldn’t have found this one.

I did my best to reach out to people using the same code. If you are using the Kirby Webmentions plugin or my fork of it, please make sure to update!

Webmentions

As some of you may know, my site supports webmentions. In short, this enables me to show replies underneath my posts, that are written by people on their own site. If you write a reply, link to me, mark it up with Microformats and send a webmention, my site fetches your post and shows it as a reply. I use a service called Bridgy to also receive comments from Twitter and Instagram. All of this is automated and very cool.

However, while very cool, it is also potentially dangerous to show external content on your site. The vulnerability I found is an example of what can go wrong.

If you look around on my site, you see I do not only show the content of the reply, but also a picture of the author, if provided. This is especially nice when showing likes:

This nice overview of likes comes from the Kirby Webmentions plugin by Bastian Allgeier, which I modified a bit.

My server takes the fall

In order to protect visitors of my site from other security issues, the plugin downloads the images and shows those downloaded ones. This way my visitors only deal with my server, and not with the servers of everyone who liked my post. It’s a nice service, but it also means that I move the problem: I now have to handle those images with care on my side. My server takes the fall for my visitors.

The problem is: my server just downloads whatever image you give it. In most cases, this will be a nice avatar I can display for my friendly visitors. But one can think of a case where a not-so-friendly visitor feeds my site something else than an image. The plugin of course checks if it’s an image and rejects files that are not a image, but it’s still worth a try.

So, what did you feed it?

Since my server runs on PHP, the nicest thing for an attacker to feed my server is a PHP-file. That way, you can run whatever code you want on my server, doing all kinds of evil things. However, just straight off feeding my site a PHP-file did not work. The plugin is not crazy. It checked wether the MIME of the file was an image of type jpeg, png or gif. It rejected an image.php file like this:

echo "hi!";

Using image.jpg as filename would fail too: the plugin saw that the file had no MIME of an image, so it did not download it. This was the point where I went to bed with a feeling of security: my site was safe and I could not get a php-script in.

The next day, however, I had second thoughts. I needed a real image for my new plan, so I took a screenshot of a smiley. I then opened it in notepad and added the following to the bottom of the file:

<?php mail(‘my.email@gmail.com’, ‘Seb’, ‘hi’);

I then renamed the file to image.php, because you need the PHP-extension in your file to let the server run your code. The last step was disabling PHP on my test-server, to prevent the test-server from executing the code and send mail me. The code just appeared at the end of the image.

I then made a test-post with a u-like-of set to the URL of a post on my blog, and a p-author h-card with an <img src="/photo.php">. It was a like, with an author and an my bad image.

And it worked.

The server sees the image and checks for the MIME, which was image/jpeg, because it was an image. It then downloaded it, including the un-executed PHP string in the bottom of it. It changed the name of the image into the SHA1-hash of the original image-url, but then it appended the extension of the original file, which was .php!

My server then had a file called a266d629bb26d74752080bb1b95bbd0a488bea53.php, which was linked as an image in my post. Every time I refreshed the page, the snippet of code in the bottom of the file got executed, so it sent an e-mail to me.

In this example, I sent an e-mail, but it could’ve been anything.

How to solve?

First off: check your input! And then check it again. A crucial thing for PHP-files is that they get executed if they have the .php extension, so you should not rely on user input for that. Change the filename and change the extension.

Bastian updated the plugin, so now it does not only check for MIME, but also only accepts files with the extensions jpg, jpeg, png and gif. Only if it has a correct extension, it downloads the file, and it checks MIME twice, both before and after the download. I think it’s locked down pretty well, although it still feels a bit scary.

Aaron Parecki, who did this way of showing likes first, uses an external service for his webmention images, and that’s not a bad idea either. If someone manages to get in something bad, it’s not on your the same server as your site. It could also be a good idea to turn off PHP for your upload folder, if you have that kind of access to your server.

Final words

I really like this webmention plugin! It’s thanks to this plugin that I know IndieWeb and all the wonderful things it brings.

But while the plugin and IndieWeb are nice, it’s also good to keep and eye on security. At this moment, webmention is relatively safe because not many people know about it or use it. Although it can be a lot of fun to have a post of a friend automatically show up beneath your post, we have to be aware of the risks of showing content of external parties.

So, be warned, and have fun.

Yeah, this is the one of the big problems with PHP, and Apache mod_php specifically. You can implement various mitigations (drop an .htaccess into the uploads directory that turns off any script execution?) but the fact that you have to is kinda ridiculous. Pretty much all other web development environments are not based around just running scripts from the same directories where static files are. Heck, Apache’s CGI implementation was better, it only ran code from the /cgi-bin/ subdirectory!

in reply to

Last week, Barry Frost released Micropublish, a Micropub client written in Ruby. It's a very slick interface for posting a few kinds of posts. I noticed that his "category" field looked really nice, and discovered that he was using a Bootstrap plugin called "Token Field". Today I added this plugin to Quill, so now everywhere that you previously had to enter tags as comma-separated values, it's now using this "token field" UI.

I also added a new field to the editor to set the published date of posts. 

All this does is include the date you enter as the published date in the Micropub request. It's up to your site to decide what to do with that. For example if you enter a date in the future, your site can decide to not show future-dated posts in feeds, so you can use this for scheduling posts. Of course if you enter a date in the past you can backdate posts such as when importing posts from an old blog.

Released last week? Oh. I guess I’ve been using the “unreleased” version. Now it has edit/delete/undelete functionality! That’s very nice.

in reply to

Of course things like software quality, bad UX (e.g. still none of the hands-off/continuity features work) are a reason for me: why would I pay the „Apple tax“ if „it simply works“ is no longer true?

Another reason is the hardware, and that's a complex one. On one hand Apple hardware is really good, e.g. the touchpads are the best I know. But on the other hand they do stupid things like soldering the SSD and RAM onto the board or gluing the battery. At least the SSD should not be soldered, as I use my hard disks heavily (due to big databases) it is likely that it breaks before the computer is broken.

Also software freedom is a reason. I like the ideals behind the GNU project and think this is the right way.

But my absolutely main reason is performance. Linux performs so much better... I have a script touching and inserting about 2 million rows, one at a time. My Linux finishes the job within two hours, while my macbook needs six(!!) hours to complete the task. The overall performance is so much better, and disk I/O is in its own league.

Yeah, the “soldered SSD” thing is extremely ridiculous. Like, they’re doing everything to make the laptops thinner, even the “Pro” line. Adding M.2 and SODIMM slots wouldn’t even add that much thickness! And M.2 allows the same performance (NVMe) as soldering the SSD.

By the way, Apple trackpads aren’t that special (until 3d touch, at least). They’re literally just Synaptics, same as in a lot of laptops.

liked

I learned a very subtle Ruby trick today.

The Ruby parser will create local variables for every variable that might be set in your code before any of it is run.

irb(main):001:0> if false; x = 1; end
=> nil
irb(main):002:0> x.inspect
=> "nil"
irb(main):003:0>

Compare with just checking for x:

irb(main):001:0> x
NameError: undefined local variable or method `x' for main:Object
from (irb):1
from /Users/aaronpk/.rubies/ruby-2.1.3/bin/irb:11:in `<main>'

Just to confirm what's happening:

irb(main):001:0> local_variables
=> [:_]
irb(main):002:0> if false; x = 1; end
=> nil
irb(main):003:0> local_variables
=> [:x, :_]
irb(main):004:0> x.inspect
=> "nil"
irb(main):005:0>

This may not seem particularly unusual at first, but has some surprising results when combined with, for example, Sinatra. Imagine you have this code that attempts to accept both a form-encoded and JSON post body.

post '/example' do
  if request.content_type.start_with? "application/json"
    begin
      params = JSON.parse(request.env["rack.input"].read)
    rescue
      return {error: "Error parsing JSON."}.to_json
    end
  end

  # etc etc
  # but params is always nil, even for form-encoded requests!
end

What's wrong with this picture? Well, the Ruby interpreter sees params = in the code and allocates a local variable. At that point, the hash that Sinatra sets isn't accessible from inside your block, so params will be nil when you try to use it!

The trick is to avoid setting params in the first place.

get '/example/:id' do
  if request.content_type == "application/json"
    begin
      payload = JSON.parse(request.env["rack.input"].read)
    rescue
      return {error: "Error parsing JSON."}.to_json
    end
  else
    payload = params
  end

  # etc etc
  # now you can use `payload` instead of params
end

Thanks @donpdonp for the hint!

in reply to

In this interesting article Wesley Moore writes about switching away from macOS. He writes about his motivation and reasons:

  • Access to regularly updated, pro hardware.
  • Not restricted to Apple hardware that makes choices that I don’t value, such as:
    • Removing the Esc key.
    • Removing all legacy ports necessitating the use of dongles for everything.
    • Prioritising thinness and weight over everything else.
  • Access to hardware that Apple doesn’t make, such as 2-in-1 laptops.
  • Getting comfortable with an alternative before I’m forced to.
  • The ability to inspect and contribute to the OS I use.
  • Using an OS where developers are first-class citizens.

I can understand his reasons: I for myself have similar problems with Apple nowadays (besides the moral issues). Interestingly he also favors elementary OS:

Elementary is stunning and definitely my favourite. It won’t appeal to everyone but their philosophies and direction really resonate with me.

I'm trying out elementary as well (using it for a week now, I am pretty happy with it), so it was nice to read that somebody else likes it as well - especially since loads of Linux users I know think that this not the way Linux is supposed to be.

I think some people didn’t like how Elementary is asking for money (pay what you want type thing) on the download page for some reason…

Honestly, I recommend not being tied to a particular OS and just, like, using all of them. I have Windows on my desktop, FreeBSD on my laptop, RPi and servers, Arch Linux in a VM… no (actively used) Macs anymore though :D

liked

Our third visit to Wales was in autumn, and though I've not yet been there during winter, I can safely state it's always beautiful.

Beddgelert is a small community; the name of the place originates from a sad story of a heroic dog. It can offer you magnificent views of the local mountains and hills so don't miss it if you're close.

Our third visit to Wales was in autumn, and though I&#39;ve not yet been there during winter, I can safely state it&#39;s always beautiful. 

Beddgelert is a small community; the name of the place originates from a sad story of a heroic dog. It can offer you magnificent views of the local mountains and hills so don&#39;t miss it if you&#39;re close.

in reply to
Recently, the homepage of this blog changed from a static list of recent blog posts to a realtime stream of updates (the list of blog posts is still there, moved to the sidebar). This post tries to document (mostly as a "note-to-self", again) how this "lifestream" works. Note: This is a work-in-progress; I've already got plans to tweak how some of the pieces fit together.

You have an interesting setup – looks like a blog with Webmention support, but GNU social for the microblog. Have you enabled the Linkback plugin on your GNU social instance? It seems to support Webmentions!