From 86596488e95cd0222e63f2270b4ed5aa103ed64d Mon Sep 17 00:00:00 2001 From: Robert Swain Date: Fri, 26 May 2017 15:26:50 +0200 Subject: [PATCH] mediaapi/writers/upload: Correct Content-Disposition evaluation Content-Disposition is not a valid request header and so it must be evaluated from the upload request's filename query parameter. --- .../matrix-org/dendrite/mediaapi/writers/upload.go | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/github.com/matrix-org/dendrite/mediaapi/writers/upload.go b/src/github.com/matrix-org/dendrite/mediaapi/writers/upload.go index 42f0bce25..3b0213577 100644 --- a/src/github.com/matrix-org/dendrite/mediaapi/writers/upload.go +++ b/src/github.com/matrix-org/dendrite/mediaapi/writers/upload.go @@ -81,7 +81,7 @@ func parseAndValidateRequest(req *http.Request, cfg *config.MediaAPI) (*uploadRe ContentDisposition: types.ContentDisposition(req.Header.Get("Content-Disposition")), FileSizeBytes: types.FileSizeBytes(req.ContentLength), ContentType: types.ContentType(req.Header.Get("Content-Type")), - UploadName: types.Filename(req.FormValue("filename")), + UploadName: types.Filename(url.PathEscape(req.FormValue("filename"))), }, Logger: util.GetLogger(req.Context()), } @@ -90,11 +90,9 @@ func parseAndValidateRequest(req *http.Request, cfg *config.MediaAPI) (*uploadRe return nil, resErr } - // FIXME: do we want to always override ContentDisposition here or only if - // there is no Content-Disposition header set? if len(r.MediaMetadata.UploadName) > 0 { r.MediaMetadata.ContentDisposition = types.ContentDisposition( - "inline; filename*=utf-8''" + url.PathEscape(string(r.MediaMetadata.UploadName)), + "inline; filename*=utf-8''" + string(r.MediaMetadata.UploadName), ) } @@ -103,8 +101,6 @@ func parseAndValidateRequest(req *http.Request, cfg *config.MediaAPI) (*uploadRe // Validate validates the uploadRequest fields func (r *uploadRequest) Validate(maxFileSizeBytes types.FileSizeBytes) *util.JSONResponse { - // TODO: Any validation to be done on ContentDisposition? - if r.MediaMetadata.FileSizeBytes < 1 { return &util.JSONResponse{ Code: 400, @@ -124,6 +120,12 @@ func (r *uploadRequest) Validate(maxFileSizeBytes types.FileSizeBytes) *util.JSO JSON: jsonerror.Unknown("HTTP Content-Type request header must be set."), } } + if r.MediaMetadata.UploadName[0] == '~' { + return &util.JSONResponse{ + Code: 400, + JSON: jsonerror.Unknown("File name must not begin with '~'."), + } + } // TODO: Validate filename - what are the valid characters? if r.MediaMetadata.UserID != "" { // TODO: We should put user ID parsing code into gomatrixserverlib and use that instead