aboutsummaryrefslogtreecommitdiffstats
path: root/spec
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2021-01-26 14:53:43 +0100
committerKim Alvefur <zash@zash.se>2021-01-26 14:53:43 +0100
commit456ca909e253ce26bf435619a91a3e1fa40f87dd (patch)
treeb7e61588f782a8ad2fc73a51164c672473da949c /spec
parenta98f3a3e64d3ae74cb666310ad465c6066025fcb (diff)
downloadprosody-456ca909e253ce26bf435619a91a3e1fa40f87dd.tar.gz
prosody-456ca909e253ce26bf435619a91a3e1fa40f87dd.zip
mod_http_file_share: Add file type filter
Unlike mod_http_upload, this can't be bypassed by uploading with a different file extension.
Diffstat (limited to 'spec')
-rw-r--r--spec/scansion/http_upload.scs13
-rw-r--r--spec/scansion/prosody.cfg.lua1
2 files changed, 14 insertions, 0 deletions
diff --git a/spec/scansion/http_upload.scs b/spec/scansion/http_upload.scs
index 72552946..ab87ddee 100644
--- a/spec/scansion/http_upload.scs
+++ b/spec/scansion/http_upload.scs
@@ -50,6 +50,19 @@ Romeo receives:
</error>
</iq>
+Romeo sends:
+ <iq to='upload.localhost' type='get' id='1401d3b5-7973-486f-85b3-3e63d13c7f0e' xml:lang='en'>
+ <request content-type='application/x-executable' filename='evil.exe' xmlns='urn:xmpp:http:upload:0' size='1000'/>
+ </iq>
+
+Romeo receives:
+ <iq id='1401d3b5-7973-486f-85b3-3e63d13c7f0e' from='upload.localhost' type='error'>
+ <error type='modify'>
+ <not-acceptable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
+ <text xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'>File type not allowed</text>
+ </error>
+ </iq>
+
Romeo disconnects
# recording ended on 2021-01-27T22:10:46Z
diff --git a/spec/scansion/prosody.cfg.lua b/spec/scansion/prosody.cfg.lua
index d0964c05..3ed97e31 100644
--- a/spec/scansion/prosody.cfg.lua
+++ b/spec/scansion/prosody.cfg.lua
@@ -134,3 +134,4 @@ Component "pubsub.localhost" "pubsub"
Component "upload.localhost" "http_file_share"
http_file_share_size_limit = 10000000
+http_file_share_allowed_file_types = { "text/plain", "image/*" }