Skip to content

Fix security issues #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Fix security issues #166

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a1ffa1d
Fix XSS
mheranco Mar 13, 2025
885bb9c
Check if requested tile resides inside the current directory
mheranco Mar 13, 2025
e24f80b
Add input validation for "renderTile"
mheranco Mar 13, 2025
1f7d3b1
Use floatval instead of "int" for casting
mheranco Mar 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions tileserver.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,16 +338,23 @@ public function isModified($filename) {
* @param string $ext
*/
public function renderTile($tileset, $z, $y, $x, $ext) {
//simple input validation
$z = floatval($z);
$y = floatval($y);
$x = floatval($x);
$alpharegex = '/^([a-zA-Z0-9-_@\.]*)$/';
if (!preg_match($alpharegex, $tileset) || !preg_match($alpharegex, $ext)) {
header('HTTP/1.1 400 Bad Request');
echo 'Server: Parameter validation failed.';
die;
}
if ($this->isDBLayer($tileset)) {
if ($this->isModified($tileset) == true) {
header('Access-Control-Allow-Origin: *');
header('HTTP/1.1 304 Not Modified');
die;
}
$this->DBconnect($this->config['dataRoot'] . $tileset . '.mbtiles');
$z = floatval($z);
$y = floatval($y);
$x = floatval($x);
$flip = true;
if ($flip) {
$y = pow(2, $z) - 1 - $y;
Expand Down Expand Up @@ -383,6 +390,14 @@ public function renderTile($tileset, $z, $y, $x, $ext) {
if($ext != null){
$name .= '.' . $ext;
}
//check if the requested file is inside the current working directory
$requestedPath = realpath($name);
$allowedBasePath = realpath(getcwd());
if (strpos($requestedPath, $allowedBasePath . DIRECTORY_SEPARATOR) !== 0) {
header('HTTP/1.1 404 Not Found');
echo 'Server: Unknown or not specified dataset "' . htmlspecialchars($tileset) . '"';
die;
}
if ($fp = @fopen($name, 'rb')) {
if($ext != null){
$mime .= $ext;
Expand All @@ -406,7 +421,7 @@ public function renderTile($tileset, $z, $y, $x, $ext) {
$this->getCleanTile($meta->scale, $ext);
} else {
header('HTTP/1.1 404 Not Found');
echo 'Server: Unknown or not specified dataset "' . $tileset . '"';
echo 'Server: Unknown or not specified dataset "' . htmlspecialchars($tileset) . '"';
die;
}
}
Expand Down