dc29a286e6
This patch fixes a security issue with all existing CodiMD and HedgeDoc installation which allows arbitary file uploads to instances that expose the `/uploadimage` API endpoint. With the patch it implies the same restrictions on the MIME-types as the frontend does. Means only images are allowed unless configured differently. This issue was reported by Thomas Lambertz. To verify if you are vulnerable or not, create two files `test.html` and `test.png` and try to upload them to your hedgedoc installation. ``` curl -X POST -F "image=@$(pwd)/test.html" http://localhost:3000/uploadimage curl -X POST -F "image=@$(pwd)/test.png" http://localhost:3000/uploadimage ``` Note: Not all backends are affected. Imgur and lutim should prevent this by their own upload API. But S3, minio, filesystem and azure, will be at risk. Addition Note: When using filesystem instead of an external uploads providers, there is a higher risk of code injections as the default CSP do not block JS from the main domain. References: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc Signed-off-by: Christoph Kern <sheogorath@shivering-isles.com> |
||
|---|---|---|
| .github | ||
| bin | ||
| docs | ||
| lib | ||
| locales | ||
| public | ||
| test | ||
| .babelrc | ||
| .editorconfig | ||
| .eslintignore | ||
| .eslintrc.js | ||
| .gitignore | ||
| .mailmap | ||
| .remarkrc | ||
| .sequelizerc.example | ||
| app.js | ||
| app.json | ||
| AUTHORS | ||
| CHANGELOG.md | ||
| CODE-OF-CONDUCT.md | ||
| config.json.example | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| package.json | ||
| README.md | ||
| renovate.json | ||
| SECURITY.md | ||
| webpack.common.js | ||
| webpack.dev.js | ||
| webpack.htmlexport.js | ||
| webpack.prod.js | ||
| yarn.lock | ||
HedgeDoc
HedgeDoc lets you create real-time collaborative markdown notes. You can test-drive it by visiting our HedgeDoc demo server.
It is inspired by Hackpad, Etherpad and similar collaborative editors. This project originated with the team at HackMD and now forked into its own organisation. A longer writeup can be read in the history doc.
Community and Contributions
We welcome contributions! There's a lot to do: If you would like to report bugs, the issue tracker is the right place. If you can help translating, find us on POEditor. To get started developing, take a look at the docs/dev directory. In any case: come talk to us, we'll be delighted to help you with the first steps.
To stay up to date with our work or get support it's recommended to join our Matrix channel, stop by our community forums or subscribe to the release feed. We also engage in regular community calls (RSS) which you are very welcome to join.
Installation / Upgrading
You can run HedgeDoc in a number of ways, and we created setup instructions for all of these:
Configuration
Theres two main ways to configure your HedgeDoc instance: config file or environment variables. You can choose what works best for you.
HedgeDoc can integrate with
- facebook, twitter, github, gitlab, mattermost, dropbox, google, ldap, saml and oauth2 for login
- imgur, s3, minio, azure for image/attachment storage (files can also be local!)
- dropbox for export and import
More info about that can be found in the configuration docs above.
Browser support
To use HedgeDoc, your browser should match or exceed these versions:
Chrome >= 47, Chrome for Android >= 47
Safari >= 9, 
iOS Safari >= 8.4
Firefox >= 44
IE >= 9, 
Edge >= 12
Opera >= 34, 
Opera Mini not supported
Android Browser >= 4.4
Backup/restore your instance
To backup HedgeDoc, you should:
- backup your database
- backup your custom config file if you have one
- backup the upload folder (see the uploadsPath config directive)
Restoring an existing instance of HedgeDoc is then just a matter of restoring these elements.
Related Tools
Our community has created related tools, we'd like to highlight hedgedoc-cli which lets you use HedgeDoc from the comfort of your command line.
License
Licensed under AGPLv3. For our list of contributors, see AUTHORS.
The license does not include the HedgeDoc logo, whose terms of usage can be found in the github repository.