WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-10-18 22:13:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(skills): authorize laravel-security download on the model before signing a URL

Browse Source 
The secure-storage example authorized `download` against a raw path string
taken from the request and generated the temporary URL before the check.
A string argument never resolves to a policy, and authorizing a
client-supplied path teaches an IDOR-prone pattern.

Bind a model (Document), authorize against it first, then sign the URL for
the stored path on the s3 disk configured just below. pi/core regenerated
via scripts/build-pi-core.js; skill-triggers registryDigest rebound.
This commit is contained in:
rhmatzeka
2026-09-30 11:32:33 +07:00
parent c70874fae9
commit eb30409fc5
3 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manifests/context-packs/skill-triggers@1.json
+1 -1
View File
File diff suppressed because one or more lines are too long
pi/core/skills/laravel-security/SKILL.md
+5 -5
View File
@@ -779,13 +779,13 @@ $path = $request->file('document')->store('documents', 'local');
// Use signed URLs for temporary file access
use Illuminate\Support\Facades\Storage;
public function download(Request $request, string $path)
public function download(Document $document)
{
// Generate temporary signed URL (expires in 15 minutes)
$url = Storage::temporaryUrl($path, now()->addMinutes(15));
// Authorize against the model that owns the file, never a path taken from the request
$this->authorize('download', $document);
// Validate user has permission
$this->authorize('download', $path);
// Generate the temporary signed URL (expires in 15 minutes) only after authorization
$url = Storage::disk('s3')->temporaryUrl($document->path, now()->addMinutes(15));
return redirect($url);
}
skills/laravel-security/SKILL.md
+5 -5
View File
@@ -779,13 +779,13 @@ $path = $request->file('document')->store('documents', 'local');
// Use signed URLs for temporary file access
use Illuminate\Support\Facades\Storage;
public function download(Request $request, string $path)
public function download(Document $document)
{
// Generate temporary signed URL (expires in 15 minutes)
$url = Storage::temporaryUrl($path, now()->addMinutes(15));
// Authorize against the model that owns the file, never a path taken from the request
$this->authorize('download', $document);
// Validate user has permission
$this->authorize('download', $path);
// Generate the temporary signed URL (expires in 15 minutes) only after authorization
$url = Storage::disk('s3')->temporaryUrl($document->path, now()->addMinutes(15));
return redirect($url);
}