I would like to brainstorm if there is anything webform itself could do to mitigate PSA-2016-003. The trouble is file fields that upload to the public file system when the form can be posted by anonymous users. So what could we do? These are just some ideas.

  • Modify the field configuration form to warn people.
  • Enforce the private file system. Speaking for myself only, I don't have any use cases where the files uploaded in a webform would need to be publicly-accessible.
  • ?

Comments

cilefen created an issue. See original summary.

cilefen’s picture

cilefen commented
Issue summary: View changes
cilefen’s picture

cilefen commented
Issue summary: View changes
cilefen’s picture

cilefen commented
Issue summary: View changes

I just posted a tiny sandbox module to enforce private files. This is what I will be using on my sites for now.

webformfileprivate.module:

/**
 * Implements hook_webform_component_presave().
 */
function webformfileprivate_webform_component_presave(&$component) {
  if ($component['type'] == 'file' && variable_get('file_private_path', FALSE)) {
    $component['extra']['scheme'] = 'private';
    drupal_set_message(t('Component <em>@name</em> was configured to use the private file system upload destination.', array('@name' => $component['name'])));
  }
}

webformfileprivate.install:

/**
 * Implements hook_requirements().
 */
function webformfileprivate_requirements($phase) {
  $requirements = array();
  $t = get_t();
  if ($phase == 'runtime' && !variable_get('file_private_path', FALSE)) {
    $requirements['webformfileprivate'] = array(
      'title' => $t('Webform File Private'),
      'value' => $t('The private file system is not configured.'),
      'severity' => REQUIREMENT_ERROR,
    );
  }
  return $requirements;
}
ilari.stenroth’s picture

ilari.stenroth commented

In case somebody has a use case to allow file submits to public file scheme but wants to be protected from malware bots with CAPTCHA or server side anti-virus scanners there's a patch to process temporary/non-validated files in Drupal's temporary file scheme: Webform issue #2816223: File component temporary uploads shouldn't be publicly reachable.

ilari.stenroth’s picture

ilari.stenroth commented

Here's a patch to fix Webform insecure default setting for upload destination:
Webform issue 2816303: File upload destination should be private files by default if avaialble.

ilari.stenroth’s picture

ilari.stenroth commented
Status: Active » Needs review

And here's my last change proposal to mitigate PSA-2016-003:
Webform issue 2816405: Warn admin users on site status report page if insecure webforms are found.

ilari.stenroth’s picture

ilari.stenroth commented
Related issues: +#2816303: File upload destination should be private files by default if available, +#2816405: Warn admin users on site status report page if insecure webforms are found
jrockowitz’s picture

jrockowitz commented

I just committed some of the thoughts and recommendations listed here to the YAML Form module (for D8).

I am fortunate that the YAML Form module has very small user base so defaulting all file uploads to private and disable public uploads is the best initial solution. Otherwise I added warnings to the 'Status report' and 'Managed file' element form. The below ticket includes screenshots of theses changes.

#2817535: Drupal file upload by anonymous or untrusted users into public file systems -- PSA-2016-003

#4 might be the best approach, since it is easy to setup private file uploads in D7.

cilefen’s picture

cilefen commented
Title: Is there anything webform can do to mitigate PSA-2016-003? » [meta] Is there anything webform can do to mitigate PSA-2016-003?
Category: Feature request » Plan
liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Status: Needs review » Active
liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Related issues: -#2816303: File upload destination should be private files by default if available, -#2816405: Warn admin users on site status report page if insecure webforms are found

These don't need to be both child and related.

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented

Private files is now the default in 7.x-4.x due to #2816303: File upload destination should be private files by default if available.

cilefen’s picture

cilefen commented
Status: Active » Closed (duplicate)

As #2816303: File upload destination should be private files by default if available covers the only two ideas I had, this is a duplicate, right?