Enforce ascii filenames for uploads

This commit is contained in:
Erik Johnston 2015-06-30 10:31:59 +01:00
parent 2124f668db
commit 9beaedd164
3 changed files with 15 additions and 1 deletions

View File

@ -27,6 +27,7 @@ from twisted.web.resource import Resource
from twisted.protocols.basic import FileSender from twisted.protocols.basic import FileSender
from synapse.util.async import ObservableDeferred from synapse.util.async import ObservableDeferred
from synapse.util.stringutils import is_ascii
import os import os
@ -135,6 +136,8 @@ class BaseMediaResource(Resource):
if content_disposition: if content_disposition:
_, params = cgi.parse_header(content_disposition[0],) _, params = cgi.parse_header(content_disposition[0],)
upload_name = params.get("filename", None) upload_name = params.get("filename", None)
if upload_name and not is_ascii(upload_name):
upload_name = None
else: else:
upload_name = None upload_name = None

View File

@ -15,7 +15,7 @@
from synapse.http.server import respond_with_json, request_handler from synapse.http.server import respond_with_json, request_handler
from synapse.util.stringutils import random_string from synapse.util.stringutils import random_string, is_ascii
from synapse.api.errors import SynapseError from synapse.api.errors import SynapseError
from twisted.web.server import NOT_DONE_YET from twisted.web.server import NOT_DONE_YET
@ -87,6 +87,8 @@ class UploadResource(BaseMediaResource):
upload_name = request.args.get("filename", None) upload_name = request.args.get("filename", None)
if upload_name: if upload_name:
upload_name = upload_name[0] upload_name = upload_name[0]
if upload_name and not is_ascii(upload_name):
raise SynapseError(400, "filename must be ascii")
headers = request.requestHeaders headers = request.requestHeaders

View File

@ -33,3 +33,12 @@ def random_string_with_symbols(length):
return ''.join( return ''.join(
random.choice(_string_with_symbols) for _ in xrange(length) random.choice(_string_with_symbols) for _ in xrange(length)
) )
def is_ascii(s):
try:
s.encode("ascii")
except UnicodeDecodeError:
return False
else:
return True