Recherche avancée

Sur d’autres sites (12284)

• Evolution #3926 : Remplacement de safehtml par le plug htmlpurifier ou autre

  17 août 2018, par Guillaume Fahrner

  Après avoir passé pas mal de temps à chercher une solution sécurisée ET fonctionnelle, voilà ce à quoi je suis arrivé sans tout casser ou devoir normaliser "100ans d’historique". La version de SPIP utilisé est SPIP 3.2.1 [23954]. En court : j’inverse la logique actuelle et je fais confiance à la sortie de safehtml du plugin Purifier :

  j’ai modifié la fonction echapper_html_suspect() de inc/texte_mini.php, la fonction echappe_anti_xss() du plugin textwheel et 2 règles YAML et... c’est tout :

  inc/texte_mini.php :
  

  <span class="CodeRay"><span class="keyword">function</span> <span class="function">echapper_html_suspect</span>(<span class="local-variable">$texte</span>, <span class="local-variable">$strict</span>=<span class="predefined-constant">true</span>) {
      <span class="keyword">if</span> (!<span class="local-variable">$texte</span>
          <span class="keyword">or</span> <span class="predefined">strpos</span>(<span class="local-variable">$texte</span>, <span class="string"><span class="delimiter">'</span><span class="content">&lt;</span><span class="delimiter">'</span></span>) === <span class="predefined-constant">false</span> <span class="keyword">or</span> <span class="predefined">strpos</span>(<span class="local-variable">$texte</span>, <span class="string"><span class="delimiter">'</span><span class="content">=</span><span class="delimiter">'</span></span>) === <span class="predefined-constant">false</span>) {
          <span class="keyword">return</span> <span class="local-variable">$texte</span>;
      }
      <span class="comment">// quand c'est du texte qui passe par propre on est plus coulant tant qu'il y a pas d'attribut du type onxxx=</span>
      <span class="comment">// car sinon on declenche sur les modeles ou ressources</span>
      <span class="keyword">if</span> (!<span class="local-variable">$strict</span> <span class="keyword">and</span>
        (<span class="predefined">strpos</span>(<span class="local-variable">$texte</span>,<span class="string"><span class="delimiter">'</span><span class="content">on</span><span class="delimiter">'</span></span>) === <span class="predefined-constant">false</span> <span class="keyword">or</span> !<span class="predefined">preg_match</span>(<span class="string"><span class="delimiter">"</span><span class="content">,&lt;</span><span class="content">\w</span><span class="content">+.*</span><span class="content">\b</span><span class="content">on</span><span class="content">\w</span><span class="content">+</span><span class="content">\s</span><span class="content">*=,UimsS</span><span class="delimiter">"</span></span>, <span class="local-variable">$texte</span>))
        ){
          <span class="keyword">return</span> <span class="local-variable">$texte</span>;
      }
   
      <span class="local-variable">$safed_texte</span> = safehtml(<span class="local-variable">$texte</span>);
      <span class="keyword">if</span> (<span class="predefined">strlen</span>(<span class="local-variable">$safed_texte</span>) !== <span class="predefined">strlen</span>(<span class="local-variable">$texte</span>)) {
          <span class="local-variable">$texte</span> = <span class="local-variable">$safed_texte</span>;
      }
      <span class="keyword">return</span> <span class="local-variable">$texte</span>;
  }
  </span>
  Télécharger

  plugins-dist/textwheel/wheels/spip/echappe-js.php :
  

  <span class="CodeRay"><span class="keyword">function</span> <span class="function">echappe_anti_xss</span>(<span class="local-variable">$match</span>) {
      <span class="keyword">static</span> <span class="local-variable">$safehtml</span>;
      <span class="keyword">if</span> (!<span class="predefined">is_array</span>(<span class="local-variable">$match</span>) <span class="keyword">or</span> !<span class="predefined">strlen</span>(<span class="local-variable">$match</span>[<span class="integer">0</span>])) {
          <span class="keyword">return</span> <span class="string"><span class="delimiter">"</span><span class="delimiter">"</span></span>;
      }
      <span class="local-variable">$texte</span> = &#38;<span class="local-variable">$match</span>[<span class="integer">0</span>];
   
      <span class="keyword">if</span> ( 
      (<span class="predefined">strpos</span>(<span class="local-variable">$texte</span>, <span class="string"><span class="delimiter">"</span><span class="content">:</span><span class="delimiter">"</span></span>) !== <span class="predefined-constant">false</span> <span class="keyword">and</span> <span class="predefined">preg_match</span>(<span class="string"><span class="delimiter">"</span><span class="content">,(data|script)</span><span class="content">\s</span><span class="content">*:,iS</span><span class="delimiter">"</span></span>, <span class="local-variable">$texte</span>) ) <span class="keyword">or</span> 
          (<span class="predefined">stripos</span>(<span class="local-variable">$texte</span>, <span class="string"><span class="delimiter">"</span><span class="content">on</span><span class="delimiter">"</span></span>) !== <span class="predefined-constant">false</span> <span class="keyword">and</span> <span class="predefined">preg_match</span>(<span class="string"><span class="delimiter">"</span><span class="content">,</span><span class="content">\b</span><span class="content">on</span><span class="content">\w</span><span class="content">+</span><span class="content">\s</span><span class="content">*=,i</span><span class="delimiter">"</span></span>, <span class="local-variable">$texte</span>) )
      ) {
          <span class="keyword">if</span> (!<span class="predefined">isset</span>(<span class="local-variable">$safehtml</span>)) {
              <span class="local-variable">$safehtml</span> = charger_fonction(<span class="string"><span class="delimiter">'</span><span class="content">safehtml</span><span class="delimiter">'</span></span>, <span class="string"><span class="delimiter">'</span><span class="content">inc</span><span class="delimiter">'</span></span>, <span class="predefined-constant">true</span>);
          }
          <span class="local-variable">$texte</span> = <span class="local-variable">$safehtml</span>(<span class="local-variable">$texte</span>);        
      }
      <span class="keyword">return</span> <span class="local-variable">$texte</span>;
  }
  </span>
  Télécharger

  plugins-dist/textwheel/wheels/spip/echappe-js.yaml :
  

  <span class="CodeRay">-
    <span class="key">if_str</span>: <span class="string"><span class="delimiter">"</span><span class="content"><code class="echappe-js">&lt;script&lt;/span&gt;&lt;span class=&quot;delimiter&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; <br />
    &lt;span class=&quot;key&quot;&gt;match&lt;/span&gt;: &lt;span class=&quot;string&quot;&gt;&lt;span class=&quot;delimiter&quot;&gt;&quot;&lt;/span&gt;&lt;span class=&quot;content&quot;&gt;{&lt;script.*?($|&lt;/script.
  Télécharger
  )isS" 
  
    is_wheel : y
  
    replace :
  
      -
  
        type : all
  
        replace : htmlspecialchars
  
        is_callback : Y
  
      -
  
        type : all
  
        replace : nl2br
  
        is_callback : Y
  
      -
  
        type : all
  
        replace : "&lt ;code class=\"echappe-js\"&gt ;$0&lt ;/code&gt ;"
   
  
    if_str : "&lt ;" 
  
    match : "&lt ;[a-z]+.* ?($|&gt ;)UisS" 
  
    is_callback : Y
  
    replace : echappe_anti_xss
  
  
  

  plugins-dist/textwheel/wheels/spip/interdire-scripts.yaml :
  

  <span class="CodeRay"><span class="key">securite-js</span>:
    <span class="key">if_str</span>: <span class="string"><span class="delimiter">"</span><span class="content">&lt;</span><span class="delimiter">"</span></span> 
    <span class="key">if_match</span>: <span class="string"><span class="delimiter">"</span><span class="content">/&lt;[a-z]+/iS</span><span class="delimiter">"</span></span> 
    <span class="key">type</span>: <span class="string"><span class="content">all</span></span>
    <span class="key">replace</span>: <span class="string"><span class="delimiter">"</span><span class="content">echappe_js</span><span class="delimiter">"</span></span> 
    <span class="key">is_callback</span>: <span class="string"><span class="content">Y</span></span>
  </span>
  Télécharger

  Pour le moment, du coté des effets de bord/choses cassées (nos fonctions sont remplis de spip_log() et on affiche le code impacté par safehtml() pour identifier rapidement les régressions) :

  • le changement de statut via le survol des puces (onmouseover inline) n’existe plus car l’attribut onmouseover est supprimé par htmlPurifier (rien de compliqué a fixer à mon sens, mieux cela oblige à développer (très) proprement, jme propose pour le patch si besoin)

  Sinon pas de problème, on publie/modifie/supprime nos objets éditoriaux comme d’habitude, leur mise en forme n’a pas bougé, on install/update/supprime nos plugins, stats OK, config OK, etc, etc (cela fait déjà plusieurs jours que nous utilisons ces modifications).

  Coté performance, la machine virtuelle est suivi via SNMP/librenms et on ne voit aucune différence d’utilisation CPU (merci le cache SPIP et OPcache) entre avant/après. D’autre part, htmlPurifier n’est pas appelé tout le temps, loin de là, on ne passe que "rarement" les conditions dans echappe_anti_xss().

  Coté sécurité :

  • les charges javascript https://gist.githubusercontent.com/kurobeats/9a613c9ab68914312cbb415134795b45/raw/954b4d3a29cd0fbeb5b841b54126326a6c14a5c1/xss_vectors.txt ont toutes été testées sans problème
  • safehtml($_GET[]) a passé les tests des scanners de vulnérabilité web BURP Pro et Acunetix Web Scanner sans problème

  Coté publication :
  Cela me semble risqué d’attendre une version majeure de SPIP avant de corriger ces problèmes de sécurité ; surtout que la transition peut se faire doucement en 3.2 avec une nouvelle version de textwheel et le remplacement (enfin) de plugin-dist/safehtml par htmlpurifier.

  En espérant que ça aide et vous serve de base pour la suite.

  g0uZ

• What is the difference between av_register_all() vs avcodec_register_all() in ffmpeg c api ?

  3 août 2018, par Nani

  I am a beginner to ffmpeg and libavcodec in c programming on a linux machine. I want to know the difference between these API’s.

• Stream video using cloudfront and ffmpeg only

  7 janvier 2014, par pkumar

  I'm new to web streaming and was doing some experiments. I was wondering if it is possible stream video using ffmpeg and AWS Cloudfront. I've following things in place :

  1. Cloudfront http and rtmp instance
  
  2. Ubuntu as OS
  
  3. A foscam ip camera at http://xxx.xxxx.net:9002 which can be accessed using url http://xxx.xxxx.net:9002/videostream.cgi?user=xxxx&password=xxxx
  
  4. jwplayer

  I used following using ffmpeg to stream data using cloudfront :

  ffmpeg -f mjpeg -i 'http://xxx.xxx.net:9002/videostream.cgi?user=xxx&pwd=xxxx'  -vcodec libx264 -crf 20 -preset veryfast -minrate 150k -maxrate 500k -s 960x540 -acodec libfaac -ar 44100 -ab 96000 -threads 0 -f flv - | tee name.flv | ffmpeg -i - -codec copy -f flv -metadata streamName=livestream rtmp://xxxxx.cloudfront.net/

  To test the ffmpeg command above, I setup a crtmpserver on local machine and replaced rtmp ://xxxxx.cloudfront.net/ with tcp ://0.0.0.0:6666. This worked fine and I could view the live stream on jwplayer once I specified the crtmpserver url for jwplayer.

  So, if it is possible, I need to do the following in descending order of preference :

  1. Stream video directly to cloudfront and access it using jwplayer using ffmpeg.
  
  2. Save video to S3 bucket using ffmpeg.

  From documentations, streaming can be done using Adobe media server, Wowza etc. I was just wondering if this can be achieved using ffmpeg and cloudfront only.