Artur WierzbickiandAgnès Toulet
e96f67ae2e
* svg fun * #50597: add proto * #50597: add sanitizer methods * #50597: add provider * #50597: use sanitizer * #50597: use sanitizer * update grafana to match new api * add comments * add capability check * add timing * update sanitize path * improve log message * strings.HasPrefix rather than filepath.IsAbs * filepath.Clean + filepath.ToSlash for windows * read 404 * remove `path.clean` from `getPathAndScope` * add resp body close * remove unneeded prop * Update pkg/services/rendering/rendering.go Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com> * remove test files * filepath.ToSlash correct wrapping * filepath.ToSlash correct wrapping * filepath.ToSlash comment * compilation error * lint fix * fix error message * Update pkg/services/rendering/rendering.go Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com> * add `image/svg+xml` mime type * refactored log * refactored log Co-authored-by: Agnès Toulet <35176601+AgnesToulet@users.noreply.github.com>
93 lines
2.3 KiB
Go
93 lines
2.3 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"path/filepath"
|
|
|
|
"github.com/grafana/grafana/pkg/infra/filestorage"
|
|
"github.com/grafana/grafana/pkg/models"
|
|
)
|
|
|
|
var (
|
|
allowedImageExtensions = map[string]bool{
|
|
".jpg": true,
|
|
".jpeg": true,
|
|
".svg": true,
|
|
".gif": true,
|
|
".png": true,
|
|
".webp": true,
|
|
}
|
|
imageExtensionsToMatchingMimeTypes = map[string]map[string]bool{
|
|
".jpg": {"image/jpg": true, "image/jpeg": true},
|
|
".jpeg": {"image/jpg": true, "image/jpeg": true},
|
|
".gif": {"image/gif": true},
|
|
".png": {"image/png": true},
|
|
".webp": {"image/webp": true},
|
|
".svg": {"text/xml; charset=utf-8": true, "text/plain; charset=utf-8": true, "image/svg+xml": true},
|
|
}
|
|
)
|
|
|
|
type validationResult struct {
|
|
ok bool
|
|
reason string
|
|
}
|
|
|
|
func success() validationResult {
|
|
return validationResult{
|
|
ok: true,
|
|
}
|
|
}
|
|
|
|
func fail(reason string) validationResult {
|
|
return validationResult{
|
|
ok: false,
|
|
reason: reason,
|
|
}
|
|
}
|
|
|
|
func (s *standardStorageService) detectMimeType(ctx context.Context, user *models.SignedInUser, uploadRequest *UploadRequest) string {
|
|
// TODO: implement a spoofing-proof MimeType detection based on the contents
|
|
return uploadRequest.MimeType
|
|
}
|
|
|
|
func (s *standardStorageService) validateImage(ctx context.Context, user *models.SignedInUser, uploadRequest *UploadRequest) validationResult {
|
|
ext := filepath.Ext(uploadRequest.Path)
|
|
if !allowedImageExtensions[ext] {
|
|
return fail("unsupported extension")
|
|
}
|
|
|
|
mimeType := s.detectMimeType(ctx, user, uploadRequest)
|
|
if !imageExtensionsToMatchingMimeTypes[ext][mimeType] {
|
|
return fail("mismatched extension and file contents")
|
|
}
|
|
|
|
return success()
|
|
}
|
|
|
|
func (s *standardStorageService) validateUploadRequest(ctx context.Context, user *models.SignedInUser, req *UploadRequest, storagePath string) validationResult {
|
|
// TODO: validateSize
|
|
// TODO: validateProperties
|
|
|
|
if err := filestorage.ValidatePath(storagePath); err != nil {
|
|
return fail("path validation failed. error:" + err.Error() + ". path: " + storagePath)
|
|
}
|
|
|
|
switch req.EntityType {
|
|
case EntityTypeFolder:
|
|
fallthrough
|
|
case EntityTypeDashboard:
|
|
// TODO: add proper validation
|
|
var something interface{}
|
|
if err := json.Unmarshal(req.Contents, &something); err != nil {
|
|
return fail(err.Error())
|
|
}
|
|
|
|
return success()
|
|
case EntityTypeImage:
|
|
return s.validateImage(ctx, user, req)
|
|
default:
|
|
return fail("unknown entity")
|
|
}
|
|
}
|