diff options
author | Patrik Ragnarsson <patrik@starkast.net> | 2023-04-25 03:41:12 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-04-25 13:41:12 +1200 |
commit | ccd445d7de85c4d5771e860add87104258b16f01 (patch) | |
tree | 803ea902b876fa4400d5ca5496ef4ab71fc0b11e | |
parent | f5666bc8cb13b8d731ea0222fbd3ada670f2cd55 (diff) | |
download | rack-ccd445d7de85c4d5771e860add87104258b16f01.tar.gz |
Limit file extension length of multipart tempfiles (#2069)
- Fixes #1968
-rw-r--r-- | lib/rack/multipart/parser.rb | 4 | ||||
-rw-r--r-- | test/spec_multipart.rb | 22 |
2 files changed, 25 insertions, 1 deletions
diff --git a/lib/rack/multipart/parser.rb b/lib/rack/multipart/parser.rb index c856b68b..cb33292e 100644 --- a/lib/rack/multipart/parser.rb +++ b/lib/rack/multipart/parser.rb @@ -59,7 +59,9 @@ module Rack BUFSIZE = 1_048_576 TEXT_PLAIN = "text/plain" TEMPFILE_FACTORY = lambda { |filename, content_type| - Tempfile.new(["RackMultipart", ::File.extname(filename.gsub("\0", '%00'))]) + extension = ::File.extname(filename.gsub("\0", '%00'))[0, 129] + + Tempfile.new(["RackMultipart", extension]) } class BoundedIO # :nodoc: diff --git a/test/spec_multipart.rb b/test/spec_multipart.rb index 48d03e43..d5ebe717 100644 --- a/test/spec_multipart.rb +++ b/test/spec_multipart.rb @@ -780,6 +780,28 @@ contents\r params["file"][:filename].must_equal 'long' * 100 end + it "limits very long file name extensions in multipart tempfiles" do + data = <<-EOF +--AaB03x\r +content-type: text/plain\r +content-disposition: attachment; name=file; filename=foo.#{'a' * 1000}\r +\r +contents\r +--AaB03x--\r + EOF + + options = { + "CONTENT_TYPE" => "multipart/form-data; boundary=AaB03x", + "CONTENT_LENGTH" => data.length.to_s, + :input => StringIO.new(data) + } + env = Rack::MockRequest.env_for("/", options) + params = Rack::Multipart.parse_multipart(env) + + params["file"][:filename].must_equal "foo.#{'a' * 1000}" + File.extname(env["rack.tempfiles"][0]).must_equal ".#{'a' * 128}" + end + it "parse unquoted parameter values at end of line" do data = <<-EOF --AaB03x\r |