Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Files not protected when auth is enabled #1101

Open
puppetm4st3r opened this issue Jun 26, 2024 · 3 comments · Fixed by #1441 · May be fixed by #1438
Open

Files not protected when auth is enabled #1101

puppetm4st3r opened this issue Jun 26, 2024 · 3 comments · Fixed by #1441 · May be fixed by #1438
Labels
auth Pertaining to authentication. evaluate-with-priority What's needed to address this one? needs-triage security

Comments

@puppetm4st3r
Copy link

puppetm4st3r commented Jun 26, 2024 •
edited
Loading

Describe the bug
When you has chainlit configured with authentication, in an incognito browser you can freely access to temporal audio files generated in audio assistants, only putting the URL in the browser like: https://192.168.0.150:8888/project/file/16745f20-dddf-4cf6-84d5-6d424635c63b?session_id=e8bafcfa-ff64-4517-bdc6-8ceddc74e89d

To Reproduce
Inspect the audio control in an authenticated chainlit instalation, copy paste the source URL from the any audio control generated by your assistant, put the link like https://192.168.0.150:8888/project/file/16745f20-dddf-4cf6-84d5-6d424635c63b?session_id=e8bafcfa-ff64-4517-bdc6-8ceddc74e89d in an incognito tab or browser.

Expected behavior
Audio files are sensitive material, if auth on chainlit is activated, then audio files must be protected some way with the JWT token, nice to have: temporary generated audio files links, in order to expire at x minutes from generation.

  • OS: Ubuntu 22
  • Browser tested on chrome, firefox
  • Version latest

Smartphone (please complete the following information):

Not tested
@dokterbob dokterbob added security evaluate-with-priority What's needed to address this one? auth Pertaining to authentication. labels Aug 14, 2024
@stephenrs stephenrs mentioned this issue Aug 26, 2024
Open
@narayan-h
Copy link

Any update on this chainlit this is really, BIG Risk

qvalentin added a commit to qvalentin/chainlit that referenced this issue Oct 16, 2024
@qvalentin
fix(security): add auth to /project/file get endpoint
01cee64 
fixes Chainlit#1101
@qvalentin qvalentin linked a pull request Oct 16, 2024 that will close this issue
Draft
@qvalentin
Copy link
Contributor

This is a significant security concern because it allows an attacker to upload a malicious file (e.g., an HTML file with inline JavaScript) and share the /project/file URL with a victim. When the victim accesses this URL, the malicious JavaScript will execute in their context, potentially extracting sensitive data like chat history.

I have opened this pull request to address this issue.

@dokterbob
Copy link
Collaborator

Really sorry, I must have missed this issue, which was created before I joined the project. Happy to see the fix, I want to try and get this solved before the next release (1.3.0).

@dokterbob dokterbob changed the title High security issue Audio files not protected when auth is enabled Oct 16, 2024
dokterbob pushed a commit that referenced this issue Oct 16, 2024
@qvalentin @dokterbob
fix(security): add auth to /project/file get endpoint
23c130a 
fixes #1101
@dokterbob dokterbob mentioned this issue Oct 16, 2024
Merged
dokterbob pushed a commit that referenced this issue Oct 16, 2024
@qvalentin @dokterbob
fix(security): add auth to /project/file get endpoint
845bb92 
fixes #1101
dokterbob pushed a commit that referenced this issue Oct 17, 2024
@qvalentin @dokterbob
fix(security): add auth to /project/file get endpoint
07fc6b1 
fixes #1101
@wenboown wenboown mentioned this issue Oct 20, 2024
Open
dokterbob added a commit that referenced this issue Oct 21, 2024
@dokterbob @qvalentin
Test and resolve security vulnerability with get_file and upload_file (…
8e1ad79 
…#1441)

* Unit tests for `get_file` and `upload_file` endpoints, including authorization.
* Add auth to /project/file get endpoint by @qvalentin , closes #1101.

---------

Co-authored-by: qvalentin <[email protected]>
@qvalentin qvalentin mentioned this issue Oct 22, 2024
Open
dokterbob added a commit that referenced this issue Oct 22, 2024
@dokterbob @qvalentin
Test and resolve security vulnerability with get_file and upload_file (…
90df80c 
…#1441)

* Unit tests for `get_file` and `upload_file` endpoints, including authorization.
* Add auth to /project/file get endpoint by @qvalentin , closes #1101.

---------

Co-authored-by: qvalentin <[email protected]>
@hayescode hayescode mentioned this issue Oct 23, 2024
Merged
dokterbob pushed a commit that referenced this issue Oct 25, 2024
@hayescode
Update server.py (#1474)
49dd1a5 
Solving the underlying issue properly requires moving to HTTP only cookies, which is out of scope for now (we want to properly clean up auth). We're gonna ship this ASAP.

This reopens #1101 and #1438 .
dokterbob pushed a commit that referenced this issue Oct 25, 2024
@hayescode @dokterbob
Update server.py (#1474)
9723622 
Solving the underlying issue properly requires moving to HTTP only cookies, which is out of scope for now (we want to properly clean up auth). We're gonna ship this ASAP.

This reopens #1101 and #1438 .
@dokterbob dokterbob reopened this Oct 25, 2024
dokterbob added a commit that referenced this issue Oct 25, 2024
@dokterbob @hayescode
Release prep for 1.3.1 (#1483)
daa960c 
* Update server.py (#1474)

Solving the underlying issue properly requires moving to HTTP only cookies, which is out of scope for now (we want to properly clean up auth). We're gonna ship this ASAP.

This reopens #1101 and #1438 .

* Changelog for 1.3.1 and 2.0.dev2.

* Bump version to 1.3.1.

---------

Co-authored-by: Josh Hayes <[email protected]>
@dokterbob dokterbob changed the title Audio files not protected when auth is enabled Files not protected when auth is enabled Nov 6, 2024
This was referenced Nov 6, 2024
Closed
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
auth Pertaining to authentication. evaluate-with-priority What's needed to address this one? needs-triage security
Projects
None yet
Milestone
No milestone
4 participants
@dokterbob @qvalentin @puppetm4st3r @narayan-h