chg: [hardening] hardened file-serving endpoints

Author: Terrtia

var/www/blueprints/objects_favicon.py

@@ -36,9 +36,9 @@
 def favicon(filename):
     if not filename:
         abort(404)
-    if not 9 <= len(filename) <= 11:
-        abort(404)
     filename = filename.replace('/', '')
+    if not 9 <= len(filename) <= 11 or not filename.isascii() or not filename.isalnum():
+        abort(404)
     fav = Favicons.Favicon(filename)
     return send_from_directory(Favicons.FAVICON_FOLDER, fav.get_rel_path(), as_attachment=False, mimetype='image')
 

var/www/blueprints/objects_image.py

@@ -36,9 +36,9 @@
 def image(filename):
     if not filename:
         abort(404)
-    if not 64 <= len(filename) <= 70:
-        abort(404)
     filename = filename.replace('/', '')
+    if not 64 <= len(filename) <= 70 or not filename.isascii() or not filename.isalnum():
+        abort(404)
     image = Images.Image(filename)
     return send_from_directory(Images.IMAGE_FOLDER, image.get_rel_path(), as_attachment=False, mimetype='image')
 

var/www/blueprints/objects_item.py

@@ -60,9 +60,9 @@ def create_json_response(data, status_code):
 def screenshot(filename):
     if not filename:
         abort(404)
-    if not 64 <= len(filename) <= 70:
-        abort(404)
     filename = filename.replace('/', '')
+    if not 64 <= len(filename) <= 70 or not filename.isascii() or not filename.isalnum():
+        abort(404)
     s = Screenshot(filename)
     return send_from_directory(SCREENSHOT_FOLDER, s.get_rel_path(add_extension=True), as_attachment=False, mimetype='image')
 

var/www/blueprints/objects_ocr.py

@@ -44,9 +44,9 @@ def create_json_response(data, status_code):
 def ocr_image(filename):
     if not filename:
         abort(404)
-    if not 64 <= len(filename) <= 70:
-        abort(404)
     filename = filename.replace('/', '')
+    if not 64 <= len(filename) <= 70 or not filename.isascii() or not filename.isalnum():
+        abort(404)
     ocr = Ocrs.Ocr(filename)
     return send_file(BytesIO(ocr.draw_bounding_boxs()), mimetype='image/png')
 

var/www/blueprints/objects_pdf.py

@@ -43,9 +43,9 @@ def create_json_response(data, status_code):
 def pdf_pdfa(pdf_id):
     if not pdf_id:
         abort(404)
-    if not 64 <= len(pdf_id):
-        abort(404)
     pdf_id = pdf_id.replace('/', '')
+    if not 64 <= len(pdf_id) or not pdf_id.isascii() or not pdf_id.isalnum():
+        abort(404)
     pdf = PDFs.PDF(pdf_id)
     return send_from_directory(PDFs.PDF_FOLDER, pdf.get_rel_path(), as_attachment=False, mimetype='pdf', download_name=f'{pdf_id}.pdf')
 

var/www/templates/domains/block_languages_search.html

@@ -46,7 +46,7 @@ <h5 class="card-title mb-0">
     function(data) {
       llanguages = $('#llanguages').tagSuggest({
         data: data,
-				value: [{%if current_languages%}{% for language in current_languages %}'{{language|safe}}',{%endfor%}{%endif%}],
+				value: [{%if current_languages%}{% for language in current_languages %}'{{language|tojson}}',{%endfor%}{%endif%}],
         sortOrder: 'name',
         maxDropHeight: 200,
         name: 'llanguages'

var/www/templates/hunter/add_retro_hunt_task.html

@@ -269,7 +269,7 @@ <h6>Custom YARA rules:</h6>
 	});
 
 	sources_item = $('#sources_item').tagSuggest({
-		data: {{items_sources|safe}},
+		data: {{items_sources|tojson}},
 		sortOrder: 'name',
 		maxDropHeight: 200,
 		name: 'sources_item',

var/www/templates/hunter/tracker_add.html

@@ -326,8 +326,8 @@ <h6>Custom YARA rules:</h6>
 
 
 	sources_item = $('#sources_item').tagSuggest({
-		data: {{all_sources|safe}},
-		{%if dict_tracker%}{%if dict_tracker['filters']%}{%if dict_tracker['filters']['item']%}{%if dict_tracker['filters']['item']['sources']%}value: {{dict_tracker['filters']['item']['sources']|safe}},{%endif%}{%endif%}{%endif%}{%endif%}
+		data: {{all_sources|tojson}},
+		{%if dict_tracker%}{%if dict_tracker['filters']%}{%if dict_tracker['filters']['item']%}{%if dict_tracker['filters']['item']['sources']%}value: {{dict_tracker['filters']['item']['sources']|tojson}},{%endif%}{%endif%}{%endif%}{%endif%}
 		sortOrder: 'name',
 		maxDropHeight: 200,
 		name: 'sources_item',

var/www/templates/import_export/block_create_misp_event.html

@@ -58,6 +58,6 @@
     maxSelection: 1,
     emptyText: 'Select MISP Account',
     name: 'user_misp',
-    {% if selector_val %}value: ['{{ selector_val | safe}}']{% endif %}
+    {% if selector_val %}value: ['{{ selector_val | tojson}}']{% endif %}
 });
 </script>

var/www/templates/investigations/view_investigation.html

@@ -250,7 +250,7 @@ <h3>Objects</h3>
       maxSelection: 1,
       emptyText: 'Select MISP Account',
       name: 'user_misp',
-      {% if selector_val %}value: ['{{ selector_val | safe}}']{% endif %}
+      {% if selector_val %}value: ['{{ selector_val | tojson}}']{% endif %}
   });
   $("#collapseMISP").addClass("collapse");