thumbor / thumbor / 26697336554

89%

push

github

fix(security): strip URL hash from prefix only to prevent signature bypass

The hash was removed from the URL before HMAC validation using
str.replace(), which replaces all occurrences. An attacker could inject
the valid hash at arbitrary positions in the image path so that both
occurrences were stripped, reconstructing the original signed URL while
the actual request pointed at a different host or path. Replace the
replace() chain with a startswith() prefix strip so the hash is only
removed from the one position where it is legitimately expected. Add two
regression tests covering the plain-hash and URL-encoded-hash injection
variants.

8 of 8 new or added lines in 1 file covered. (100.0%)

3940 of 4431 relevant lines covered (88.92%)

4.45 hits per line