To render on threejs, we need some images(jpg/png) and , jsons(uv data). All these files are stored in respective folders and the files visible for clients to look at.
I use django/python to start a local server, python code is compiled to .pyc & js code is obfuscated. But the folder structure is accessible for Casual Users. In threejs, we use tex_loader and json_loader functions to which the file paths are given as inputs. Was looking at ways of securing the behind the scenes work.
Happened to read about custom binary formats, but that felt like a lot of work.
or giving access to files only for certain process starting through django/web browser?
Are there any available easy to deploy solutions to protect our IP ?
An option would be to only serve the files to authenticated users. This could be achieved by having an endpoint on your backend like:
api/assets/data.json
and the controller in the backend would receive the file name(data.json), the code could check if the user requesting the endpoint is authenticated and if so read the file from the file system(my-private-folder/assets/data.json) and return it as file with correct mime-type to the browser.
Related
I am in a basic Next.js/Node.js project, and want to load a YAML "page metadata" file to generate a social media image. The metadata only has title, url, and image and such. The problem is, I load this YAML metadata from a file that is based on the URL, which can potentially be hacked.
So if I have a URL like /foo/bar/baz, I want to load the YAML config for that page inside $APP_FOLDER/data/pages/foo/bar/baz/metadata.yaml. The problem I'm imagining (in Node.js), is you change the URL to /../../something-secret like even /../../package.json, and doing the following will load the package.json:
fs.readFileSync(`${process.cwd()}/data/pages/${urlPath}`)
So it would resolve to (for example):
fs.readFileSync(`./data/pages/../../package.json`)
I don't want that, that is a security problem.
So I think about the path module, and doing path.relative(a, b), but I'm not sure that is correct or would solve the problem.
My question is kind of generic though, how do I (in Node.js) prevent a user from navigating the file system like this? How can I enforce "only allow searching within the ./data/pages folder recursively"?
Could you put these static files inside the /public directory of your Next.js project? Then you could more safely fetch from URLs instead of local file system. Also, Since Next.js primarily makes isomorphic React apps, you will probably have trouble using fs, or other Node modules that you wouldn't find in the browser, unless you try the new experimental "app" directory.
I'm fairly new to web development and I can't really find the best way to handle serving files with Django.
My situation is:
I have users from different departments that can upload, edit and download files. Users should have access to files from other users of the same department, but not of the others.
The way it works until now is: each file path is written in a database, with a reference to which department it belongs. If requesting a file Django checks if the department of the user is the same as the file, and denies access if that is not the case. So it's implemented using a normal view that returns a StreamingHttpResponse.
After researching a bit it seemed that serving files that way isn't the standard way, and I should serve them as static files (from the web server, not directly by Django). My question is: can I still restrict the access of static files, or can anyone read them?
I'm wondering how to deal with importing files, when I work with a frontend hosted on OVH, and a backend hosted on Heroku.
So, here is my logic, I would like to know if it makes sense to you :
I create a route in my API that will store the file in my backend server
I update the user profile with a string that correspond to the path of the file
From the front, I ask a route that will ask the file to the backend with the path stored in mongoDB
Does that make sense ?
I think what you described makes a lot of sense. However I suggest a minor change, Instead of saving file path in user profile, save the complete hosted URL of the file. This will come in handy if you choose to change your image hosting solution later on and also reduces the dependency between your client and backend.
I have a web application where user can upload and view files. The user has a link next to the file (s)he has uploaded. Clicking on the link will open the file in the browser (if possible) or show the download dialog (of the browser). Meaning that, if the user upload an html/pdf/txt file it will be rendered in the browser but if it is a word document, it will be downloaded.
It is identified that rendering the HTML file in the browser could be a vulnerability - Cross Site Scripting.
What is the right solution to this problem? The two options I am currently looking at are:
to put Content-Disposition header in the response to make HTML files downloaded instead viewed in the browser.
to find some html scrubbing/sanitizing library to remove any javascript from the file before I serve it.
Looking at the gmail, they do the second approach (of scrubbing) with having a separate domain for the file download - may be to minimize/distract the attack surface. However in this approach the receiver gets a different file than what was sent. Which is not 'right' in my opinion; may be I am biased. In my case, the first one is easy to fix. But I wonder if that is enough, or is there any thing that I overlook!
What are your thoughts on these approaches? Or do you have any other suggestions?
Based on your description, I can see 3 posible attack types (maybe there are more):
Client side code execution
As you said, your web server may serve a file as HTML and run javascript code on the client. This can be avoided with Content-Disposition but I would go with MIME types control through Content-Type. I would define my known type of files (e.g. pdf, jpeg etc.) and serve them with their respective MIME type (e.g. application/pdf, image/jpeg etc.). Anything else I would serve it as application/octet-stream.
Server side code execution
Althougth I see this as an out of topic attack (since it involves other parts of your application and your server) be sure to avoid executing files on the server (e.g. PHP code through LFI). Your webserver should not access directly the files (e.g. again PHP), better store them somethere not accesible through a URL and retrive them on request.
Think if here you are able to reject files (e.g. reject .exe uploads) and ask the user to zip them first.
Trust issues
Since the files are under the same domain, the files will be accesible from javascript (ajax or load as script) and other programs (or people) may trust your links. This is also related to the previous point, if you don't need unzipped exe files, don't allow them. Using an other domain may mitigate some trust problems.
Other ideas:
Zip all files uploaded
Scan each file with antivirus software
PS: For me sanitization would not work in your case. The risk of missing something is too high.
I want to export a table to an Excel file. I need to export a report.
ORA_EXCEL.new_document;
ORA_EXCEL.add_sheet('Sheet name');
ORA_EXCEL.query_to_sheet('select * from mytable');
ORA_EXCEL.save_to_blob(myblob);
I saved my table to blob.
How do I export/respond to the user (client)?
I need something that is simple to allow a user to be able to download an Excel file to their own computer. I tried doing this procedure in an Oracle workflow:
ORA_EXCEL.save_to_file('EXPORT_DIR', 'example.xlsx');
But this did not help, because it is saves the file to a directory on the server and I need it in the real server.
The way I have handled similar issues in the past was to work with the systems people to mount a directory from either a web server or file server on the Database server.
Then create a directory object so that the procedure can save to a location that is accessible to the user.
If the files are not sensitive and there are a limited number of users then a file server makes sense as it is then just a matter of giving the user access to the file share.
If files are sensitive or this is a large number or unknown users we then used the Web server and sent a email with a link to the user enabling them to download their file. Naturally there needs to be security built into this to stop people being able to download other users files.
We didn't just email the files as an attachment because...
1) Emails with attachments tend to get blocked
2) We always advise not to open attachments on emails. (Yes I know we advise not to click on links as well but nothing is perfect)
Who or what is invoking the production of the document?
If it´s done by an application, which the user is working on, this application can fetch the BLOB, stores it at f.e. TEMP-Directory and calls
System.Diagnostics.Process.Start("..."); to open it with the associated application. (see Open file with associated application)
If it´s a website, this one could stream the blob back as Excel-Mimetype (see Setting mime type for excel document)
Also you could store in an Oracle-DIRECTORY, but this one has to be on the server and should be a netword-share to be accessible for clients (which is rarely accepted in a productive environment!)
If MAIL isn´t the solution, then maybe FTP can be a way to store files in a common share. See UTL_TCP - Package, with this a FTP-transfer can be achieved (a bit hard to code, but there are solutions to find in the web) and I guess, professional tools that generate Office-documents out of Oracle-DB and distribute them do it like this.