[high] cover_image_key mass assignment → path traversal → arbitrary file delete #7

New issue

Closed

opened 2026-10-18 15:51:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:55 +00:00

Owner

Severity: high
Affects: main (also present on jtk/ebook-management)

Files: lib/fuzzy_catalog/catalog/book.ex:52 (cast includes :cover_image_key), lib/fuzzy_catalog/storage/backends/local_backend.ex:70-73 (build_file_path = Path.join(base, key)), book_controller.ex:282-288 (delete) and :529-539 (remove_cover)
A user sets book[cover_image_key]=../../../ on create/update, then deletes the book or sends remove_cover=true → File.rm on that path. Same key feeds exists?/retrieve_url.
Fix: drop :cover_image_key from the user-facing changeset (set it only server-side via put_change). In LocalBackend.build_file_path use Path.safe_relative/2 and refuse keys outside base_path.

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** high **Affects:** main (also present on jtk/ebook-management) Files: lib/fuzzy_catalog/catalog/book.ex:52 (cast includes :cover_image_key), lib/fuzzy_catalog/storage/backends/local_backend.ex:70-73 (build_file_path = Path.join(base, key)), book_controller.ex:282-288 (delete) and :529-539 (remove_cover) A user sets book[cover_image_key]=../../../<file> on create/update, then deletes the book or sends remove_cover=true → File.rm on that path. Same key feeds exists?/retrieve_url. Fix: drop :cover_image_key from the user-facing changeset (set it only server-side via put_change). In LocalBackend.build_file_path use Path.safe_relative/2 and refuse keys outside base_path. --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

labels

2026-10-18 15:51:55 +00:00

jfro referenced this issue from a commit

2026-10-18 15:59:13 +00:00

fix: stop book params from setting cover_image_key and confine storage keys

jfro referenced this issue from a pull request that will close it,

2026-10-18 15:59:23 +00:00