diff options
| -rw-r--r-- | plugins/mod_http_file_share.lua | 6 | ||||
| -rw-r--r-- | spec/scansion/http_upload.scs | 13 |
2 files changed, 19 insertions, 0 deletions
diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua index 4c9dc9e9..89dda500 100644 --- a/plugins/mod_http_file_share.lua +++ b/plugins/mod_http_file_share.lua @@ -36,6 +36,7 @@ end local upload_errors = errors.init(module.name, namespace, { access = { "auth"; "forbidden" }; + filename = { "modify"; "bad-request", "Invalid filename" }; }); function may_upload(uploader, filename, filesize, filetype) -- > boolean, error @@ -44,6 +45,11 @@ function may_upload(uploader, filename, filesize, filetype) -- > boolean, error return false, upload_errors.new("access"); end + if not filename or filename:find"/" then + -- On Linux, only '/' and '\0' are invalid in filenames and NUL can't be in XML + return false, upload_errors.new("filename"); + end + return true; end diff --git a/spec/scansion/http_upload.scs b/spec/scansion/http_upload.scs index a683483e..ed4f1bca 100644 --- a/spec/scansion/http_upload.scs +++ b/spec/scansion/http_upload.scs @@ -21,6 +21,19 @@ Romeo receives: </slot> </iq> +Romeo sends: + <iq to='upload.localhost' type='get' id='ac56d83f-a627-4732-8399-60492d1210b6' xml:lang='en'> + <request content-type='text/plain' filename='invalid/filename.dat' xmlns='urn:xmpp:http:upload:0' size='1000'/> + </iq> + +Romeo receives: + <iq id='ac56d83f-a627-4732-8399-60492d1210b6' from='upload.localhost' type='error'> + <error type='modify'> + <bad-request xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/> + <text xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'>Invalid filename</text> + </error> + </iq> + Romeo disconnects # recording ended on 2021-01-27T22:10:46Z |