diff options
| author | Kim Alvefur <zash@zash.se> | 2021-01-26 14:53:43 +0100 |
|---|---|---|
| committer | Kim Alvefur <zash@zash.se> | 2021-01-26 14:53:43 +0100 |
| commit | 456ca909e253ce26bf435619a91a3e1fa40f87dd (patch) | |
| tree | b7e61588f782a8ad2fc73a51164c672473da949c /spec | |
| parent | a98f3a3e64d3ae74cb666310ad465c6066025fcb (diff) | |
| download | prosody-456ca909e253ce26bf435619a91a3e1fa40f87dd.tar.gz prosody-456ca909e253ce26bf435619a91a3e1fa40f87dd.zip | |
mod_http_file_share: Add file type filter
Unlike mod_http_upload, this can't be bypassed by uploading with a
different file extension.
Diffstat (limited to 'spec')
| -rw-r--r-- | spec/scansion/http_upload.scs | 13 | ||||
| -rw-r--r-- | spec/scansion/prosody.cfg.lua | 1 |
2 files changed, 14 insertions, 0 deletions
diff --git a/spec/scansion/http_upload.scs b/spec/scansion/http_upload.scs index 72552946..ab87ddee 100644 --- a/spec/scansion/http_upload.scs +++ b/spec/scansion/http_upload.scs @@ -50,6 +50,19 @@ Romeo receives: </error> </iq> +Romeo sends: + <iq to='upload.localhost' type='get' id='1401d3b5-7973-486f-85b3-3e63d13c7f0e' xml:lang='en'> + <request content-type='application/x-executable' filename='evil.exe' xmlns='urn:xmpp:http:upload:0' size='1000'/> + </iq> + +Romeo receives: + <iq id='1401d3b5-7973-486f-85b3-3e63d13c7f0e' from='upload.localhost' type='error'> + <error type='modify'> + <not-acceptable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/> + <text xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'>File type not allowed</text> + </error> + </iq> + Romeo disconnects # recording ended on 2021-01-27T22:10:46Z diff --git a/spec/scansion/prosody.cfg.lua b/spec/scansion/prosody.cfg.lua index d0964c05..3ed97e31 100644 --- a/spec/scansion/prosody.cfg.lua +++ b/spec/scansion/prosody.cfg.lua @@ -134,3 +134,4 @@ Component "pubsub.localhost" "pubsub" Component "upload.localhost" "http_file_share" http_file_share_size_limit = 10000000 +http_file_share_allowed_file_types = { "text/plain", "image/*" } |