Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2025-10-02 07:08:27 -04:00
Code Issues Projects Releases Packages Wiki Activity

Strip overlong OpenGraph data from url preview

Browse source 
... to stop people causing DoSes with malicious web pages
This commit is contained in:
Richard van der Hoff 2019-11-05 15:45:17 +00:00
parent 9ffcf0f7ba
commit e9bfe719ba
3 changed files with 54 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

34
tests/rest/media/v1/test_url_preview.py
View file

@ -247,6 +247,40 @@ class URLPreviewTests(unittest.HomeserverTestCase):
self.assertEqual(channel.code, 200)
self.assertEqual(channel.json_body["og:title"], "\u0434\u043a\u0430")
def test_overlong_title(self):
self.lookups["matrix.org"] = [(IPv4Address, "8.8.8.8")]
end_content = (
b"<html><head>"
b"<title>" + b"x" * 2000 + b"</title>"
b'<meta property="og:description" content="hi" />'
b"</head></html>"
)
request, channel = self.make_request(
"GET", "url_preview?url=http://matrix.org", shorthand=False
)
request.render(self.preview_url)
self.pump()
client = self.reactor.tcpClients[0][2].buildProtocol(None)
server = AccumulatingProtocol()
server.makeConnection(FakeTransport(client, self.reactor))
client.makeConnection(FakeTransport(server, self.reactor))
client.dataReceived(
(
b"HTTP/1.0 200 OK\r\nContent-Length: %d\r\n"
b'Content-Type: text/html; charset="windows-1251"\r\n\r\n'
)
% (len(end_content),)
+ end_content
)
self.pump()
self.assertEqual(channel.code, 200)
res = channel.json_body
self.assertCountEqual(["og:description"], res.keys())
def test_ipaddr(self):
"""
IP addresses can be previewed directly.