mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 13:47:41 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_http_file_share: Reject invalid file sizes

Browse source
This commit is contained in:
Kim Alvefur 2021-01-27 00:36:49 +01:00
parent 4b74c6abb7
commit 8485e85c70
2 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
plugins/mod_http_file_share.lua
View file

@ -48,6 +48,7 @@ local upload_errors = errors.init(module.name, namespace, {
filetype = { type = "modify"; condition = "not-acceptable"; text = "File type not allowed" }; filetype = { type = "modify"; condition = "not-acceptable"; text = "File type not allowed" };
filesize = { type = "modify"; condition = "not-acceptable"; text = "File too large"; filesize = { type = "modify"; condition = "not-acceptable"; text = "File too large";
extra = {tag = st.stanza("file-too-large", {xmlns = namespace}):tag("max-file-size"):text(tostring(file_size_limit)) }; extra = {tag = st.stanza("file-too-large", {xmlns = namespace}):tag("max-file-size"):text(tostring(file_size_limit)) };
filesizefmt = { type = "modify"; condition = "bad-request"; text = "File size must be positive integer"; }
}; };
}); });
@ -62,6 +63,9 @@ function may_upload(uploader, filename, filesize, filetype) -- > boolean, error
return false, upload_errors.new("filename"); return false, upload_errors.new("filename");
end end
if not filesize or filesize < 0 or filesize % 1 ~= 0 then
return false, upload_errors.new("filesizefmt");
end
if filesize > file_size_limit then if filesize > file_size_limit then
return false, upload_errors.new("filesize"); return false, upload_errors.new("filesize");
end end

13
spec/scansion/http_upload.scs
View file

@ -37,6 +37,19 @@ Romeo receives:
</error> </error>
</iq> </iq>
Romeo sends:
<iq to='upload.localhost' type='get' id='497c20dd-dda2-4feb-8199-7086e203de46' xml:lang='en'>
<request content-type='text/plain' filename='negative.dat' xmlns='urn:xmpp:http:upload:0' size='-1000'/>
</iq>
Romeo receives:
<iq id='497c20dd-dda2-4feb-8199-7086e203de46' from='upload.localhost' type='error'>
<error type='modify'>
<bad-request xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
<text xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'>File size must be positive integer</text>
</error>
</iq>
Romeo sends: Romeo sends:
<iq to='upload.localhost' type='get' id='ac56d83f-a627-4732-8399-60492d1210b6' xml:lang='en'> <iq to='upload.localhost' type='get' id='ac56d83f-a627-4732-8399-60492d1210b6' xml:lang='en'>
<request content-type='text/plain' filename='invalid/filename.dat' xmlns='urn:xmpp:http:upload:0' size='1000'/> <request content-type='text/plain' filename='invalid/filename.dat' xmlns='urn:xmpp:http:upload:0' size='1000'/>