From bab1ab5b6c74de5f02d9ddd06f0026efa547c2a5 Mon Sep 17 00:00:00 2001 From: FloatingGhost Date: Thu, 10 Nov 2022 11:54:12 +0000 Subject: [PATCH] strip \r and \r from content-disposition filenames --- lib/pleroma/web/plugs/uploaded_media.ex | 9 ++++++++- test/pleroma/web/plugs/uploaded_media_plug_test.exs | 11 +++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/lib/pleroma/web/plugs/uploaded_media.ex b/lib/pleroma/web/plugs/uploaded_media.ex index 7b87d8f17..72f20e8de 100644 --- a/lib/pleroma/web/plugs/uploaded_media.ex +++ b/lib/pleroma/web/plugs/uploaded_media.ex @@ -35,7 +35,7 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do conn = case fetch_query_params(conn) do %{query_params: %{"name" => name}} = conn -> - name = String.replace(name, "\"", "\\\"") + name = escape_header_value(name) put_resp_header(conn, "content-disposition", "filename=\"#{name}\"") @@ -98,4 +98,11 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do |> send_resp(:internal_server_error, dgettext("errors", "Internal Error")) |> halt() end + + defp escape_header_value(value) do + value + |> String.replace("\"", "\\\"") + |> String.replace("\\r", "") + |> String.replace("\\n", "") + end end diff --git a/test/pleroma/web/plugs/uploaded_media_plug_test.exs b/test/pleroma/web/plugs/uploaded_media_plug_test.exs index 75f313282..c71a7e789 100644 --- a/test/pleroma/web/plugs/uploaded_media_plug_test.exs +++ b/test/pleroma/web/plugs/uploaded_media_plug_test.exs @@ -40,4 +40,15 @@ defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do &(&1 == {"content-disposition", "filename=\"\\\"cofe\\\".gif\""}) ) end + + test "removes control characters from the Content-Disposition header", %{ + attachment_url: attachment_url + } do + conn = get(build_conn(), attachment_url <> "?name=\"cofe\".gif\\r\\n") + + assert Enum.any?( + conn.resp_headers, + &(&1 == {"content-disposition", "filename=\"\\\"cofe\\\".gif\""}) + ) + end end -- 2.45.2