umputun / remark42 / 40837879860

86%

push

github

Reject unsafe image IDs taken from comment HTML (#2277)

* Reject unsafe image IDs taken from comment HTML

extractImageIDs built an image ID from the last two segments of any img
src pointing at the picture API, with no check for "." or "..". FileSystem
joined that ID into a path, so a commenter could aim the preview's stat and
chtimes, and an admin's later deletion of the comment, at a file next to the
image directories. With --image.fs.partitions=0 that includes the bolt
database.

Extraction now keeps an ID only when both segments pass
image.SafeIDSegment, the check the picture GET handler already used, and
every FileSystem operation rejects an unsafe ID before building a path.

Reported by Zachariah Mithani (AploSec).

* Close the image file after FileSystem.Load reads it

Load opened the file and returned io.ReadAll without closing it, so every
picture request held a file descriptor until a garbage collection ran the
os.File finalizer. Switching to os.ReadFile closes the file on success and
on error.

* Skip the Load descriptor test where /dev/fd is missing

TestFsStore_LoadClosesFile counts open files through /dev/fd, which
Windows does not have, so the test failed there whatever Load did. It now
skips when the directory is absent.

* Note that comment delete removes images used on other pages

* Bump golang.org/x/net to v0.62.0 for GO-2026-6866 and GO-2026-6860

govulncheck flags both advisories in the html package, which goquery
reaches from the comment formatter and image id extraction. The bump also
raises golang.org/x/crypto, sync, sys and text to the versions x/net
v0.62.0 requires, and the example module is tidied to match.

* Key the e2e playwright cache on the runner image

ubuntu-latest moved to 26.04, and the cache keyed only on e2e/go.sum
restored the WebKit build made for 24.04, which needs libicu74 and fails
to launch. Playwright ships WebKit per Ubuntu release under one revision
directory and skips the download when that director... (continued)

31 of 31 new or added lines in 3 files covered. (100.0%)

6099 of 7214 relevant lines covered (84.54%)

32.44 hits per line