Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(security): URL import with own range check and a generic error (audit M3, cheap part)

Browse Source 
PublicAddress blocks every private/reserved IPv4 and IPv6 range
(169.254/16, 100.64/10, fc00::/7, fe80::/10, IPv4-mapped/NAT64/6to4 by
their embedded address, ...) independent of the core version; checked
before the request and on every redirect (Requests before_redirect).
Network failures return only "Die Datei konnte nicht geladen werden.";
the detail goes to the error log. DNS-rebinding pinning stays deferred.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 19:27:11 +02:00
co-authored by Claude Opus 5.5
parent 0531a5ffb1
commit 7f361304ae
8 changed files with 318 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Integration/media-admin-smoke.sh
+4
View File
@@ -73,6 +73,10 @@ pass "upload, search, preview, update (single ok, mixed batch refused), download
# 3. Import protection
SSRF=$(tool lit-media-upload-from-url '{"url":"http://127.0.0.1/wp-login.php"}')
[ "$(error_code "$SSRF")" = "validation_failed" ] || fail "internal URL accepted: $SSRF"
for internal in "http://169.254.169.254/latest/meta-data/" "http://100.64.0.1/x.png" "http://[::ffff:127.0.0.1]/x.png"; do
BLOCKED=$(tool lit-media-upload-from-url "$(jq -cn --arg u "$internal" '{url: $u}')")
[ "$(error_code "$BLOCKED")" = "validation_failed" ] || fail "internal URL $internal accepted: $BLOCKED"
done
FAKE=$(ability lit/media-upload "{\"filename\":\"evil.png\",\"data\":\"$(printf '<?php echo 1;' | base64 -w0)\"}")
[ "$(error_code "$FAKE")" = "validation_failed" ] || fail "disguised PHP accepted: $FAKE"
EXTERNAL=$(tool lit-media-upload-from-url '{"url":"https://s.w.org/images/wmark.png","title":"LIT Smoke Extern"}')