Inputs, uploads and imports
What is this about?
Everything that comes from outside is checked before Illumentis processes it: texts from the editor, uploaded files and imports. We allow only what we explicitly know and reject everything else instead of changing it silently. This reduces the risk, but no check finds everything.
Protection goal
A crafted input, file or import should neither reach other users’ data, nor bring in harmful code, nor knock the service over.
How it works
- Allowlist instead of blocklist: The text in the editor is a structured tree. Every kind of building block, every formatting and every attribute is on an allowlist. An unknown building block makes the whole request fail; it is not removed silently.
- Limits: The size and nesting of content and the length of inputs are limited so that crafted input cannot overload the service.
- Checking more than once: When the text is displayed in the browser, it is cleaned once more in case something slipped through.
- Files: The type of a file is determined by its content, not by its extension. File names cannot point to other directories. Uploads are scanned for malware, and if the scan is not possible, the upload is rejected.
- Imports: Archives are checked before they are unpacked. When reading XML, no external resources are loaded. Imported data ends up only in your own project.
- Export: The creation of documents has no access to the network, and references are checked once more right before.
Measures
- We use an allowlist to rule out unknown and new forms of attack instead of blocking only known ones.
- We reject instead of repairing, so that no half-cleaned input is stored.
- Input is not taken blindly into data objects. Only fields that are explicitly intended get through.
- Uploads, imports and exports are limited in how often they can run, so that they cannot be used for overload.
- Important check patterns are tested so that crafted input cannot slow them down.
What we do not promise
- No check recognizes all malware, new malware in particular.
- Files from an unknown source remain a risk, even if Illumentis checks them. This applies especially if you open them outside Illumentis.
- The checks can reject unusual but harmless input. We accept that.
- We deliberately do not name concrete limits.
How we check this
The safeguards have automated tests, which the table below names. The “API Manipulation” scenario is in the monthly report.
Evidence tests
| Test | What the test proves |
|---|---|
ChapterContentAstSecurityTest |
Crafted texts, content that is too deep or too large and broken building blocks are rejected without leaving traces. |
ChapterContentSanitizerTest |
The allowlist for building blocks, formatting and attributes of the editor text applies. |
ExternalManuscriptImportSecurityTest |
Imported manuscript files are checked for content, size and file name. |
JsonImportSecurityTest |
A project import writes only to your own project and rejects overload from crafted files. |
ExportRenderingHasNoNetworkAccessTest |
Document export does not access the network. |
MediaAssetMalwareScanTest |
Uploaded files are scanned for malware. |
AvatarUploadTest |
Uploaded profile pictures are checked before they are accepted. |
MassAssignmentProtectionTest |
Input is not taken blindly into data objects. |
RegexTimeoutGuardTest |
Important check patterns cannot be slowed down by crafted input. |
Change history
- : First version.