Software / code / prosody
Changeset
11319:a4b299e37909
mod_http_file_share: Reject invalid file sizes
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Wed, 27 Jan 2021 00:36:49 +0100 |
| parents | 11318:3b16aba6285f |
| children | 11320:817cadf6be92 |
| files | plugins/mod_http_file_share.lua spec/scansion/http_upload.scs |
| diffstat | 2 files changed, 17 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/plugins/mod_http_file_share.lua Wed Jan 27 00:29:12 2021 +0100 +++ b/plugins/mod_http_file_share.lua Wed Jan 27 00:36:49 2021 +0100 @@ -48,6 +48,7 @@ filetype = { type = "modify"; condition = "not-acceptable"; text = "File type not allowed" }; filesize = { type = "modify"; condition = "not-acceptable"; text = "File too large"; extra = {tag = st.stanza("file-too-large", {xmlns = namespace}):tag("max-file-size"):text(tostring(file_size_limit)) }; + filesizefmt = { type = "modify"; condition = "bad-request"; text = "File size must be positive integer"; } }; }); @@ -62,6 +63,9 @@ return false, upload_errors.new("filename"); end + if not filesize or filesize < 0 or filesize % 1 ~= 0 then + return false, upload_errors.new("filesizefmt"); + end if filesize > file_size_limit then return false, upload_errors.new("filesize"); end
--- a/spec/scansion/http_upload.scs Wed Jan 27 00:29:12 2021 +0100 +++ b/spec/scansion/http_upload.scs Wed Jan 27 00:36:49 2021 +0100 @@ -38,6 +38,19 @@ </iq> Romeo sends: + <iq to='upload.localhost' type='get' id='497c20dd-dda2-4feb-8199-7086e203de46' xml:lang='en'> + <request content-type='text/plain' filename='negative.dat' xmlns='urn:xmpp:http:upload:0' size='-1000'/> + </iq> + +Romeo receives: + <iq id='497c20dd-dda2-4feb-8199-7086e203de46' from='upload.localhost' type='error'> + <error type='modify'> + <bad-request xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/> + <text xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'>File size must be positive integer</text> + </error> + </iq> + +Romeo sends: <iq to='upload.localhost' type='get' id='ac56d83f-a627-4732-8399-60492d1210b6' xml:lang='en'> <request content-type='text/plain' filename='invalid/filename.dat' xmlns='urn:xmpp:http:upload:0' size='1000'/> </iq>
