diff options
| author | Kim Alvefur <zash@zash.se> | 2021-01-26 14:52:37 +0100 |
|---|---|---|
| committer | Kim Alvefur <zash@zash.se> | 2021-01-26 14:52:37 +0100 |
| commit | ea3b09dea83fd372f471dd01b87ef36566773a84 (patch) | |
| tree | abc5cd2ce959966cd704d304a4b6879ed46a8fe8 /plugins/mod_http_file_share.lua | |
| parent | 62f77b9ac97454a783a003c47c84761100c37237 (diff) | |
| download | prosody-ea3b09dea83fd372f471dd01b87ef36566773a84.tar.gz prosody-ea3b09dea83fd372f471dd01b87ef36566773a84.zip | |
mod_http_file_share: Validate that filename does not contain '/'
Diffstat (limited to 'plugins/mod_http_file_share.lua')
| -rw-r--r-- | plugins/mod_http_file_share.lua | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua index 4c9dc9e9..89dda500 100644 --- a/plugins/mod_http_file_share.lua +++ b/plugins/mod_http_file_share.lua @@ -36,6 +36,7 @@ end local upload_errors = errors.init(module.name, namespace, { access = { "auth"; "forbidden" }; + filename = { "modify"; "bad-request", "Invalid filename" }; }); function may_upload(uploader, filename, filesize, filetype) -- > boolean, error @@ -44,6 +45,11 @@ function may_upload(uploader, filename, filesize, filetype) -- > boolean, error return false, upload_errors.new("access"); end + if not filename or filename:find"/" then + -- On Linux, only '/' and '\0' are invalid in filenames and NUL can't be in XML + return false, upload_errors.new("filename"); + end + return true; end |