Skip to content

Fix: Prevent object injection via unserialize on LogViewer encrypted URL params #1716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pandigresik wants to merge 1 commit into
base: rilis-dev
Choose a base branch
from
Open

Fix: Prevent object injection via unserialize on LogViewer encrypted URL params #1716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions app/Http/Controllers/LogViewerController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,11 +81,11 @@ public function index()
{
$folderFiles = [];
if ($this->request->input('f')) {
$this->log_viewer->setFolder(Crypt::decrypt($this->request->input('f')));
$this->log_viewer->setFolder(Crypt::decryptString($this->request->input('f')));
$folderFiles = $this->log_viewer->getFolderFiles(true);
}
if ($this->request->input('l')) {
$this->log_viewer->setFile(Crypt::decrypt($this->request->input('l')));
$this->log_viewer->setFile(Crypt::decryptString($this->request->input('l')));
}

if ($early_return = $this->earlyReturn()) {
Expand Down Expand Up @@ -143,7 +143,7 @@ public function index()
private function earlyReturn()
{
if ($this->request->input('f')) {
$this->log_viewer->setFolder(Crypt::decrypt($this->request->input('f')));
$this->log_viewer->setFolder(Crypt::decryptString($this->request->input('f')));
}

if ($this->request->input('dl')) {
Expand Down Expand Up @@ -178,7 +178,7 @@ private function earlyReturn()
*/
private function pathFromInput($input_string)
{
return $this->log_viewer->pathToLogFile(Crypt::decrypt($this->request->input($input_string)));
return $this->log_viewer->pathToLogFile(Crypt::decryptString($this->request->input($input_string)));
}

/**
Expand Down
10 changes: 5 additions & 5 deletions resources/views/vendor/laravel-log-viewer/log.blade.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
<div class="box-body no-padding">
<ul class="nav nav-pills nav-stacked">
@foreach ($files as $file)
<li @if ($current_file == $file) class="active" @endif><a href="?l={{ \Illuminate\Support\Facades\Crypt::encrypt($file) }}"> {{ $file }}
<li @if ($current_file == $file) class="active" @endif><a href="?l={{ \Illuminate\Support\Facades\Crypt::encryptString($file) }}"> {{ $file }}
</a></li>
@endforeach
</ul>
Expand All @@ -43,22 +43,22 @@
<div class="p-3">
@if ($current_file)
<a class="btn btn-social btn-sm btn-success visible-xs-block visible-sm-inline-block visible-md-inline-block visible-lg-inline-block"
href="?dl={{ \Illuminate\Support\Facades\Crypt::encrypt($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encrypt($current_folder) : '' }}"
href="?dl={{ \Illuminate\Support\Facades\Crypt::encryptString($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encryptString($current_folder) : '' }}"
>
<span class="fa fa-download"></span> Unduh
</a>
<a class="btn btn-social btn-sm btn-info visible-xs-block visible-sm-inline-block visible-md-inline-block visible-lg-inline-block" id="clean-log"
href="?clean={{ \Illuminate\Support\Facades\Crypt::encrypt($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encrypt($current_folder) : '' }}"
href="?clean={{ \Illuminate\Support\Facades\Crypt::encryptString($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encryptString($current_folder) : '' }}"
>
<span class="fa fa-times-circle"></span> Bersihkan File
</a>
<a class="btn btn-social btn-sm btn-danger visible-xs-block visible-sm-inline-block visible-md-inline-block visible-lg-inline-block" id="delete-log"
href="?del={{ \Illuminate\Support\Facades\Crypt::encrypt($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encrypt($current_folder) : '' }}"
href="?del={{ \Illuminate\Support\Facades\Crypt::encryptString($current_file) }}{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encryptString($current_folder) : '' }}"
>
<span class="fa fa-trash"></span> Hapus File
</a>
@if (count($files) > 1)
<a id="delete-all-log" class="btn btn-social btn-sm btn-danger visible-sm-inline-block visible-md-inline-block visible-lg-inline-block" href="?delall=true{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encrypt($current_folder) : '' }}">
<a id="delete-all-log" class="btn btn-social btn-sm btn-danger visible-sm-inline-block visible-md-inline-block visible-lg-inline-block" href="?delall=true{{ $current_folder ? '&f=' . \Illuminate\Support\Facades\Crypt::encryptString($current_folder) : '' }}">
<span class="fa fa-trash"></span> Hapus Semua file
</a>
@endif
Expand Down
74 changes: 74 additions & 0 deletions tests/Feature/LogViewerControllerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
<?php

/*
* File ini bagian dari:
*
* OpenDK
*
* Aplikasi dan source code ini dirilis berdasarkan lisensi GPL V3
*
* Hak Cipta 2017 - 2025 Perkumpulan Desa Digital Terbuka (https://opendesa.id)
*
* Dengan ini diberikan izin, secara gratis, kepada siapa pun yang mendapatkan salinan
* dari perangkat lunak ini dan file dokumentasi terkait ("Aplikasi Ini"), untuk diperlakukan
* tanpa batasan, termasuk hak untuk menggunakan, menyalin, mengubah dan/atau mendistribusikan,
* asal tunduk pada syarat berikut:
*
* Pemberitahuan hak cipta di atas dan pemberitahuan izin ini harus disertakan dalam
* setiap salinan atau bagian penting Aplikasi Ini. Barang siapa yang menghapus atau menghilangkan
* pemberitahuan ini melanggar ketentuan lisensi Aplikasi Ini.
*
* PERANGKAT LUNAK INI DISEDIAKAN "SEBAGAIMANA ADANYA", TANPA JAMINAN APA PUN, BAIK TERSURAT MAUPUN
* TERSIRAT. PENULIS ATAU PEMEGANG HAK CIPTA SAMA SEKALI TIDAK BERTANGGUNG JAWAB ATAS KLAIM, KERUSAKAN ATAU
* KEWAJIBAN APAPUN ATAS PENGGUNAAN ATAU LAINNYA TERKAIT APLIKASI INI.
*
* @package OpenDK
* @author Tim Pengembang OpenDesa
* @copyright Hak Cipta 2017 - 2025 Perkumpulan Desa Digital Terbuka (https://opendesa.id)
* @license http://www.gnu.org/licenses/gpl.html GPL V3
* @link https://github.com/OpenSID/opendk
*/

use App\Http\Middleware\Authenticate;
use App\Http\Middleware\CompleteProfile;
use App\Http\Middleware\GlobalShareMiddleware;
use Illuminate\Foundation\Testing\DatabaseTransactions;
use Illuminate\Support\Facades\Crypt;
use Spatie\Permission\Middleware\PermissionMiddleware;
use Spatie\Permission\Middleware\RoleMiddleware;

uses(DatabaseTransactions::class);

class ObjectInjectionGadget
{
public static $wokenUp = false;

public function __wakeup()
{
self::$wokenUp = true;
}
}

beforeEach(function () {
ObjectInjectionGadget::$wokenUp = false;

$this->withoutMiddleware([
Authenticate::class,
RoleMiddleware::class,
PermissionMiddleware::class,
CompleteProfile::class,
GlobalShareMiddleware::class,
]);
});

test('user-supplied log params are decrypted without unserialization', function () {
// Payload dibuat seolah-olah oleh penyerang yang memiliki APP_KEY:
// menyerupai Crypt::decrypt() lama (unserialize=true) terhadap input user.
// decryptString() mengembalikan string mentah tanpa unserialize, sehingga
// object tidak pernah diinstansiasi (tidak ada side effect __wakeup()).
$malicious = Crypt::encryptString(serialize(new ObjectInjectionGadget));

$this->get(route('setting.info-sistem').'?f='.urlencode($malicious));

expect(ObjectInjectionGadget::$wokenUp)->toBeFalse();
});
Loading