Git-Mirrors/mat2-web
1
0
Fork 0
mirror of https://0xacab.org/jvoisin/mat2-web.git synced 2025-02-23 08:39:57 -05:00
Code Issues Packages Projects Releases Wiki Activity

Resolve "Fuzzing Errors /api/upload"

Browse Source
This commit is contained in:
jfriedli 2020-05-08 09:10:18 -07:00
parent 9157dee69f
commit 853ace7d83
5 changed files with 46 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
matweb/frontend.py
View File

@ -53,8 +53,12 @@ def upload_file():
if not uploaded_file.filename:
flash('No selected file')
return redirect(request.url)
try:
filename, filepath = utils.save_file(uploaded_file, current_app.config['UPLOAD_FOLDER'])
except ValueError:
flash('Invalid Filename')
return redirect(request.url)
filename, filepath = utils.save_file(uploaded_file, current_app.config['UPLOAD_FOLDER'])
parser, mime = utils.get_file_parser(filepath)
if parser is None:

10
matweb/rest_api.py
View File

@ -28,11 +28,15 @@ class APIUpload(Resource):
args = req_parser.parse_args()
try:
file_data = base64.b64decode(args['file'])
except binascii.Error as err:
abort(400, message='Failed decoding file: ' + str(err))
except (binascii.Error, ValueError):
abort(400, message='Failed decoding file')
file = FileStorage(stream=io.BytesIO(file_data), filename=args['file_name'])
filename, filepath = utils.save_file(file, self.upload_folder)
try:
filename, filepath = utils.save_file(file, self.upload_folder)
except ValueError:
abort(400, message='Invalid Filename')
parser, mime = utils.get_file_parser(filepath)
if parser is None:

2
matweb/utils.py
View File

@ -65,6 +65,8 @@ def get_supported_extensions():
def save_file(file, upload_folder):
filename = secure_filename(file.filename)
if not filename:
raise ValueError('Invalid Filename')
filepath = os.path.join(upload_folder, filename)
file.save(os.path.join(filepath))
return filename, filepath

12
test/test.py
View File

@ -179,6 +179,18 @@ class Mat2WebTestCase(TestCase):
self.assertIn(b'.mp2', rv.data)
self.assertEqual(rv.status_code, 200)
def test_get_upload_naughty_input(self):
rv = self.client.post(
'/',
data=dict(
file=(io.BytesIO(b"a"), '﷽'),
),
follow_redirects=True
)
self.assertEqual(rv.status_code, 200)
self.assertIn(b'Invalid Filename', rv.data)
if __name__ == '__main__':
unittest.main()

21
test/test_api.py
View File

@ -70,7 +70,7 @@ class Mat2APITestCase(unittest.TestCase):
self.assertEqual(request.status_code, 400)
error = request.get_json()['message']
self.assertEqual(error, 'Failed decoding file: Incorrect padding')
self.assertEqual(error, 'Failed decoding file')
def test_api_not_supported(self):
request = self.app.post('/api/upload',
@ -400,6 +400,25 @@ class Mat2APITestCase(unittest.TestCase):
request = app.get(download_link)
self.assertEqual(code, request.status_code)
def test_upload_naughty_input(self):
request = self.app.post('/api/upload',
data='{"file_name": "\\\\", '
'"file": "\\\\"}',
headers={'content-type': 'application/json'}
)
error_message = request.get_json()['message']
self.assertEqual(400, request.status_code)
self.assertEqual("Invalid Filename", error_message)
request = self.app.post('/api/upload',
data='{"file_name": "﷽", '
'"file": "﷽"}',
headers={'content-type': 'application/json'}
)
error_message = request.get_json()['message']
self.assertEqual(400, request.status_code)
self.assertEqual("Failed decoding file", error_message)
if __name__ == '__main__':
unittest.main()