🔒️(backend) fix two WOPI security bypasses - #795
Merged
Conversation
NathanVss
approved these changes
Aug 4, 2026
| invalid_filename_error = "No filename provided" | ||
| else: | ||
| # Convert it to utf-7 to avoid issues with special characters | ||
| new_filename = new_filename.encode("ascii").decode("utf-7") |
Contributor
There was a problem hiding this comment.
Why utf-7, why not utf-8 as utf-7 is considered obsolete?
Collaborator
Author
There was a problem hiding this comment.
utf-7 is part of wopi specs…
| # non-READY files in WOPI. | ||
| item.save(update_fields=["size", "updated_at"]) | ||
|
|
||
| malware_detection.analyse_file(item.file_key, item_id=item.id) |
Contributor
There was a problem hiding this comment.
This approach leave a window during which a dangerous file is in READY state.
That being said, to avoid degrading live edition I understand we have no better choice for now.
The fine grade solution is indeed only allowing wopi editors to access the wopi API via this PR: #416
kernicPanel
force-pushed
the
fix/wopi-security-bypasses
branch
from
August 7, 2026 08:33
97af154 to
a4ba208
Compare
The requested name was decoded from UTF-7 and used as is, so a path separator could reach the storage key and leave the item without an extension. A second rename then granted it any extension, bypassing the allowed list that only the upload path enforced. Extensions are now compared case insensitively on both sides, so entries declared with capitals are no longer dead.
PutFile wrote the content straight to object storage, while malware detection only ran on the upload endpoint. Editing a document was therefore a way to store content that was never analysed. The item stays READY during the analysis: a collaborator cannot open a file that is not READY, so flipping the state would eject everyone from the document on every save.
kernicPanel
force-pushed
the
fix/wopi-security-bypasses
branch
from
August 7, 2026 10:39
8487176 to
9ec7288
Compare
|
lunika
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Two WOPI endpoints let a standard user store a file that neither the
allowed extension list nor the antivirus ever checked.
RENAME_FILEused the requested name as decoded, without validating theresulting extension.
PutFilewrote content straight to object storagewithout triggering malware detection, which only ran on the upload
endpoint.
Proposal
disallowed extension, and compare extensions case insensitively