From ea3b09dea83fd372f471dd01b87ef36566773a84 Mon Sep 17 00:00:00 2001
From: Kim Alvefur <zash@zash.se>
Date: Tue, 26 Jan 2021 14:52:37 +0100
Subject: mod_http_file_share: Validate that filename does not contain '/'

---
 plugins/mod_http_file_share.lua |  6 ++++++
 spec/scansion/http_upload.scs   | 13 +++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua
index 4c9dc9e9..89dda500 100644
--- a/plugins/mod_http_file_share.lua
+++ b/plugins/mod_http_file_share.lua
@@ -36,6 +36,7 @@ end
 
 local upload_errors = errors.init(module.name, namespace, {
 	access = { "auth"; "forbidden" };
+	filename = { "modify"; "bad-request", "Invalid filename" };
 });
 
 function may_upload(uploader, filename, filesize, filetype) -- > boolean, error
@@ -44,6 +45,11 @@ function may_upload(uploader, filename, filesize, filetype) -- > boolean, error
 		return false, upload_errors.new("access");
 	end
 
+	if not filename or filename:find"/" then
+		-- On Linux, only '/' and '\0' are invalid in filenames and NUL can't be in XML
+		return false, upload_errors.new("filename");
+	end
+
 	return true;
 end
 
diff --git a/spec/scansion/http_upload.scs b/spec/scansion/http_upload.scs
index a683483e..ed4f1bca 100644
--- a/spec/scansion/http_upload.scs
+++ b/spec/scansion/http_upload.scs
@@ -21,6 +21,19 @@ Romeo receives:
 		</slot>
 	</iq>
 
+Romeo sends:
+	<iq to='upload.localhost' type='get' id='ac56d83f-a627-4732-8399-60492d1210b6' xml:lang='en'>
+		<request content-type='text/plain' filename='invalid/filename.dat' xmlns='urn:xmpp:http:upload:0' size='1000'/>
+	</iq>
+
+Romeo receives:
+	<iq id='ac56d83f-a627-4732-8399-60492d1210b6' from='upload.localhost' type='error'>
+		<error type='modify'>
+			<bad-request xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
+			<text xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'>Invalid filename</text>
+		</error>
+	</iq>
+
 Romeo disconnects
 
 # recording ended on 2021-01-27T22:10:46Z
-- 
cgit v1.2.3