Software / code / prosody
Diff
plugins/mod_http_file_share.lua @ 11313:e53894d26092
mod_http_file_share: Validate that filename does not contain '/'
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Tue, 26 Jan 2021 14:52:37 +0100 |
| parent | 11312:aade4a6179a3 |
| child | 11314:7c8b02c5a335 |
line wrap: on
line diff
--- a/plugins/mod_http_file_share.lua Tue Jan 26 14:51:55 2021 +0100 +++ b/plugins/mod_http_file_share.lua Tue Jan 26 14:52:37 2021 +0100 @@ -36,6 +36,7 @@ local upload_errors = errors.init(module.name, namespace, { access = { "auth"; "forbidden" }; + filename = { "modify"; "bad-request", "Invalid filename" }; }); function may_upload(uploader, filename, filesize, filetype) -- > boolean, error @@ -44,6 +45,11 @@ return false, upload_errors.new("access"); end + if not filename or filename:find"/" then + -- On Linux, only '/' and '\0' are invalid in filenames and NUL can't be in XML + return false, upload_errors.new("filename"); + end + return true; end
