mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 13:47:41 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_http_file_share: Add file type filter

Browse source 
Unlike mod_http_upload, this can't be bypassed by uploading with a
different file extension.
This commit is contained in:
Kim Alvefur 2021-01-26 14:53:43 +01:00
parent a98f3a3e64
commit 456ca909e2
3 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
plugins/mod_http_file_share.lua
View file

@ -29,6 +29,7 @@ local uploads = module:open_store("uploads", "archive");
local secret = module:get_option_string(module.name.."_secret", require"util.id".long()); local secret = module:get_option_string(module.name.."_secret", require"util.id".long());
local external_base_url = module:get_option_string(module.name .. "_base_url"); local external_base_url = module:get_option_string(module.name .. "_base_url");
local file_size_limit = module:get_option_number(module.name .. "_size_limit", 10 * 1024 * 1024); -- 10 MB local file_size_limit = module:get_option_number(module.name .. "_size_limit", 10 * 1024 * 1024); -- 10 MB
local file_types = module:get_option_set(module.name .. "_allowed_file_types", {});
local access = module:get_option_set(module.name .. "_access", {}); local access = module:get_option_set(module.name .. "_access", {});
@ -44,6 +45,7 @@ module:add_extension(dataform {
local upload_errors = errors.init(module.name, namespace, { local upload_errors = errors.init(module.name, namespace, {
access = { "auth"; "forbidden" }; access = { "auth"; "forbidden" };
filename = { "modify"; "bad-request", "Invalid filename" }; filename = { "modify"; "bad-request", "Invalid filename" };
filetype = { "modify"; "not-acceptable", "File type not allowed" };
filesize = { "modify"; "not-acceptable"; "File too large"; filesize = { "modify"; "not-acceptable"; "File too large";
st.stanza("file-too-large", {xmlns = namespace}):tag("max-size"):text(tostring(file_size_limit)); }; st.stanza("file-too-large", {xmlns = namespace}):tag("max-size"):text(tostring(file_size_limit)); };
}); });
@ -63,6 +65,10 @@ function may_upload(uploader, filename, filesize, filetype) -- > boolean, error
return false, upload_errors.new("filesize"); return false, upload_errors.new("filesize");
end end
if not ( file_types:empty() or file_types:contains(filetype) or file_types:contains(filetype:gsub("/.*", "/*")) ) then
return false, upload_errors.new("filetype");
end
return true; return true;
end end

13
spec/scansion/http_upload.scs
View file

@ -50,6 +50,19 @@ Romeo receives:
</error> </error>
</iq> </iq>
Romeo sends:
<iq to='upload.localhost' type='get' id='1401d3b5-7973-486f-85b3-3e63d13c7f0e' xml:lang='en'>
<request content-type='application/x-executable' filename='evil.exe' xmlns='urn:xmpp:http:upload:0' size='1000'/>
</iq>
Romeo receives:
<iq id='1401d3b5-7973-486f-85b3-3e63d13c7f0e' from='upload.localhost' type='error'>
<error type='modify'>
<not-acceptable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
<text xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'>File type not allowed</text>
</error>
</iq>
Romeo disconnects Romeo disconnects
# recording ended on 2021-01-27T22:10:46Z # recording ended on 2021-01-27T22:10:46Z

1
spec/scansion/prosody.cfg.lua
View file

@ -134,3 +134,4 @@ Component "pubsub.localhost" "pubsub"
Component "upload.localhost" "http_file_share" Component "upload.localhost" "http_file_share"
http_file_share_size_limit = 10000000 http_file_share_size_limit = 10000000
http_file_share_allowed_file_types = { "text/plain", "image/*" }