darkkirb/akkoma
1
0
Fork 0
forked from mirrors/akkoma
Code Pull requests Activity

strip \r and \r from content-disposition filenames

Browse source
This commit is contained in:
FloatingGhost 2022-11-10 11:54:12 +00:00
parent dcc36df8cf
commit bab1ab5b6c
2 changed files with 19 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/pleroma/web/plugs/uploaded_media.ex
View file

@ -35,7 +35,7 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
conn =
case fetch_query_params(conn) do
%{query_params: %{"name" => name}} = conn ->
name = String.replace(name, "\"", "\\\"")
name = escape_header_value(name)
put_resp_header(conn, "content-disposition", "filename=\"#{name}\"")
@ -98,4 +98,11 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
|> send_resp(:internal_server_error, dgettext("errors", "Internal Error"))
|> halt()
end
defp escape_header_value(value) do
value
|> String.replace("\"", "\\\"")
|> String.replace("\\r", "")
|> String.replace("\\n", "")
end
end

11
test/pleroma/web/plugs/uploaded_media_plug_test.exs
View file

@ -40,4 +40,15 @@ defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do
&(&1 == {"content-disposition", "filename=\"\\\"cofe\\\".gif\""})
)
end
test "removes control characters from the Content-Disposition header", %{
attachment_url: attachment_url
} do
conn = get(build_conn(), attachment_url <> "?name=\"cofe\".gif\\r\\n")
assert Enum.any?(
conn.resp_headers,
&(&1 == {"content-disposition", "filename=\"\\\"cofe\\\".gif\""})
)
end
end