security(#283): sniff artwork content type from bytes, remove serve-side ?contentType= reflection #291

Merged

timothy merged 5 commits from fix/283-artwork-content-type-xss into main 2026-07-12 01:00:55 +02:00

Conversation 1 Commits 5 Files Changed 24

+330 -75

5 Commits

Author	SHA1	Message	Date
timothy	f8fd9084d1	Merge main (CI migration-job retry #294 + #197 tests) into fix/283 ... # Conflicts: # docs/decisions.md	2026-07-12 00:52:20 +02:00
timothyandClaude Opus 4.8	db9fc59660	ci: re-trigger CI into idle runner (MySQL apply-all flake under load) ... Run 516's MySQL "apply all migrations to a fresh DB" died with MySqlEndOfStreamException (incomplete response) — the shared MySQL service container under concurrent-run load, same class as run 513's Command Timeout. Model-drift (has-pending-model-changes) passed for BOTH providers, so the diff is model-clean; another branch's run (515) passed the identical job. Contention has cleared; re-triggering. Tree unchanged from b6f12f7e. Refs #283 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 00:34:20 +02:00
timothyandClaude Opus 4.8	2a6fa2694a	ci: re-trigger CI (MySQL migration-integrity command-timeout flake) ... Run 513's "EF migration integrity" job failed with "The Command Timeout expired" applying all migrations to a fresh MySQL under concurrent-run contention. The tree is unchanged from b6f12f7e (Build & test green there and on the pre-clamp cf834d8b; the change touches no EF/model/migration code). Empty commit to get a clean run. Refs #283 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 00:28:02 +02:00
timothyandClaude Opus 4.8	b6f12f7e2c	security(#283): clamp served artwork MIME type to the image allow-list ... Cold-review LOW (defense-in-depth): the serve path derived the Content-Type from the stored file via Winista but only defaulted application/octet-stream on a NULL sniff. A cache file whose bytes are HTML — a legacy entry poisoned before the upload-sniff landed, or a hypothetical image/script polyglot — could still be sniffed as text/html and served renderable (nosniff does not stop an explicitly declared text/html). Clamp the sniffed type to ImageContentTypes.IsAccepted, serving application/octet-stream for anything else, so the serve path can never emit a renderable non-image type regardless of what bytes are on disk. Refs #283 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 00:15:56 +02:00
timothyandClaude Opus 4.8	cf834d8b60	security(#283): sniff artwork content type from bytes, remove serve-side ?contentType= reflection ... S4 stored-XSS + S9 upload-size DoS from the #197 cold API review. The artwork path trusted client-supplied content types at both ends: upload validated only the declared multipart Content-Type (never decoded the bytes), and serving reflected a client `?contentType=` straight into the response Content-Type on unauthenticated GET sinks (/iptv/logos, /artwork/watermarks). Chain: upload <script> bytes as image/png -> GET ...?contentType=text/html serves them as HTML in-origin. nosniff (#279) does not help because the server explicitly declares text/html. - Upload: derive the content type from the bytes via SkiaSharp SKCodec (header-only, no decode -> no decompression-bomb path); reject non-images 422. New ErsatzTV.Core/Images/ImageContentTypes as the single allow-list source. Dropped the untrusted declared Content-Type from the UploadArtwork command. - Serve: removed the ?contentType= reflection structurally -- dropped ContentType from GetCachedImagePath and the [FromQuery] binding on GetImage/GetWatermark; the handler always sniffs the file, defaulting application/octet-stream. ArtworkContentTypeModel.UrlWithContentType is now the bare path; SPA previews no longer append the query. - Defense-in-depth: channel-logo / watermark {path, contentType} DTOs run through ArtworkContentTypeModel.Sanitized(), blanking non-allow-listed types on write. - S9: Kestrel MaxRequestBodySize from ETV_MAXIMUM_UPLOAD_MB rejects oversized bodies during read (controller file.Length check kept as friendly-error backstop). Both serve sinks are IgnoreApi, so no OpenAPI change. Tests: byte-sniff accept/ reject, Sanitized() allow-list, Location no longer carries ?contentType=. Docs: api-conventions §4a + decisions.md 2026-07-12. Refs #283 #197 #66 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 00:07:55 +02:00