go-pkgz / auth
85%
master: 85%

LAST BUILD BRANCH: docs/comment-sweep
DEFAULT BRANCH: master
Repo Added
Files 25
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH refs/tags/v1.25.4
branch: refs/tags/v1.25.4
CHANGE BRANCH
x

coverage: 85.425% (+0.1%) from 85.291%
26198178420

push

github

web-flow 
fix(avatar): prevent stored XSS via content-type spoofing (#290)

* fix(avatar): reject non-image content to prevent stored XSS via content-type spoofing

The avatar proxy stored whatever bytes upstream returned at u.Picture and served
them back with whatever http.DetectContentType decided — including text/html for
HTML/script payloads. A user whose login flow allows attacker-controlled u.Picture
(custom OAuth provider, self-signup with picture URL) could plant HTML in the avatar
store and have it served from the auth-service origin as text/html, executing JS in
that origin.

Layered defense:

  * Proxy.resize() validates input via image.DecodeConfig (cheap, no pixel
    allocation) before any image.Decode. Refuses non-image content with nil so
    attacker payloads (HTML / SVG / text) never reach Store.Put. Previously it
    silently fell back to teeBuf on decode failure, poisoning the store.
  * Per-pixel cap maxAvatarPixels (16 MP) rejects compressed decompression-bomb
    images that would force image.Decode to allocate gigabytes of raster memory
    on a single login attempt. Multiplication uses int64 to avoid wraparound on
    32-bit builds (GOARCH=386, 32-bit arm) where the int32 product of 16-bit GIF
    or JPEG dimensions would otherwise bypass the cap.
  * The no-resize path (limit<=0 or image already fits) returns the original
    bytes verbatim so animated GIFs and other multi-frame formats round-trip
    without being flattened to the first frame.
  * Proxy.Put() falls back to a generated identicon when resize() returns nil.
  * Proxy.PutContent() returns an explicit error for non-image input.
  * Proxy.Handler() validates served bytes via the new safeImgContentType helper
    (strict allowlist: image/{png,jpeg,gif,webp,bmp,x-icon}; image/svg+xml is
    explicitly rejected because SVG can execute scripts when navigated to top
    level). This catches stores poisoned before this fix and any future
    regression at serve time.
  * Every Ha... (continued)

96 of 105 new or added lines in 2 files covered. (91.43%)

3042 of 3561 relevant lines covered (85.43%)

8.31 hits per line

Relevant lines Covered
3561 RELEVANT LINES 3042 COVERED LINES
8.31 HITS PER LINE
Source Files on refs/tags/v1.25.4

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
26198178420 refs/tags/v1.25.4 fix(avatar): prevent stored XSS via content-type spoofing (#290) * fix(avatar): reject non-image content to prevent stored XSS via content-type spoofing The avatar proxy stored whatever bytes upstream returned at u.Picture and served them back w... push web-flow github
85.43
26198178419 refs/tags/v1.25.4 fix(avatar): prevent stored XSS via content-type spoofing (#290) * fix(avatar): reject non-image content to prevent stored XSS via content-type spoofing The avatar proxy stored whatever bytes upstream returned at u.Picture and served them back w... push web-flow github
85.39
See All Builds (1078)