mirror of
https://git.anonymousland.org/anonymousland/synapse.git
synced 2024-09-06 21:21:58 +00:00
Enforce ascii filenames for uploads
This commit is contained in:
parent
2124f668db
commit
9beaedd164
@ -27,6 +27,7 @@ from twisted.web.resource import Resource
|
|||||||
from twisted.protocols.basic import FileSender
|
from twisted.protocols.basic import FileSender
|
||||||
|
|
||||||
from synapse.util.async import ObservableDeferred
|
from synapse.util.async import ObservableDeferred
|
||||||
|
from synapse.util.stringutils import is_ascii
|
||||||
|
|
||||||
import os
|
import os
|
||||||
|
|
||||||
@ -135,6 +136,8 @@ class BaseMediaResource(Resource):
|
|||||||
if content_disposition:
|
if content_disposition:
|
||||||
_, params = cgi.parse_header(content_disposition[0],)
|
_, params = cgi.parse_header(content_disposition[0],)
|
||||||
upload_name = params.get("filename", None)
|
upload_name = params.get("filename", None)
|
||||||
|
if upload_name and not is_ascii(upload_name):
|
||||||
|
upload_name = None
|
||||||
else:
|
else:
|
||||||
upload_name = None
|
upload_name = None
|
||||||
|
|
||||||
|
@ -15,7 +15,7 @@
|
|||||||
|
|
||||||
from synapse.http.server import respond_with_json, request_handler
|
from synapse.http.server import respond_with_json, request_handler
|
||||||
|
|
||||||
from synapse.util.stringutils import random_string
|
from synapse.util.stringutils import random_string, is_ascii
|
||||||
from synapse.api.errors import SynapseError
|
from synapse.api.errors import SynapseError
|
||||||
|
|
||||||
from twisted.web.server import NOT_DONE_YET
|
from twisted.web.server import NOT_DONE_YET
|
||||||
@ -87,6 +87,8 @@ class UploadResource(BaseMediaResource):
|
|||||||
upload_name = request.args.get("filename", None)
|
upload_name = request.args.get("filename", None)
|
||||||
if upload_name:
|
if upload_name:
|
||||||
upload_name = upload_name[0]
|
upload_name = upload_name[0]
|
||||||
|
if upload_name and not is_ascii(upload_name):
|
||||||
|
raise SynapseError(400, "filename must be ascii")
|
||||||
|
|
||||||
headers = request.requestHeaders
|
headers = request.requestHeaders
|
||||||
|
|
||||||
|
@ -33,3 +33,12 @@ def random_string_with_symbols(length):
|
|||||||
return ''.join(
|
return ''.join(
|
||||||
random.choice(_string_with_symbols) for _ in xrange(length)
|
random.choice(_string_with_symbols) for _ in xrange(length)
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
|
def is_ascii(s):
|
||||||
|
try:
|
||||||
|
s.encode("ascii")
|
||||||
|
except UnicodeDecodeError:
|
||||||
|
return False
|
||||||
|
else:
|
||||||
|
return True
|
||||||
|
Loading…
Reference in New Issue
Block a user