summary refs log tree commit diff
path: root/synapse/rest/media/v1
diff options
context:
space:
mode:
authorErik Johnston <erik@matrix.org>2015-06-30 10:31:59 +0100
committerErik Johnston <erik@matrix.org>2015-06-30 10:31:59 +0100
commit9beaedd1642673d36428dd796dda62f18a937c2a (patch)
treea0cf3fbef32d851abc0ae922a9a62646c292eae3 /synapse/rest/media/v1
parentAdd Content-Disposition headers to media repo v1 downloads (diff)
downloadsynapse-9beaedd1642673d36428dd796dda62f18a937c2a.tar.xz
Enforce ascii filenames for uploads
Diffstat (limited to 'synapse/rest/media/v1')
-rw-r--r--synapse/rest/media/v1/base_resource.py3
-rw-r--r--synapse/rest/media/v1/upload_resource.py4
2 files changed, 6 insertions, 1 deletions
diff --git a/synapse/rest/media/v1/base_resource.py b/synapse/rest/media/v1/base_resource.py
index 04410ab827..1b7517e2f0 100644
--- a/synapse/rest/media/v1/base_resource.py
+++ b/synapse/rest/media/v1/base_resource.py
@@ -27,6 +27,7 @@ from twisted.web.resource import Resource
 from twisted.protocols.basic import FileSender
 
 from synapse.util.async import ObservableDeferred
+from synapse.util.stringutils import is_ascii
 
 import os
 
@@ -135,6 +136,8 @@ class BaseMediaResource(Resource):
             if content_disposition:
                 _, params = cgi.parse_header(content_disposition[0],)
                 upload_name = params.get("filename", None)
+                if upload_name and not is_ascii(upload_name):
+                    upload_name = None
             else:
                 upload_name = None
 
diff --git a/synapse/rest/media/v1/upload_resource.py b/synapse/rest/media/v1/upload_resource.py
index 92e855a448..cdd1d44e07 100644
--- a/synapse/rest/media/v1/upload_resource.py
+++ b/synapse/rest/media/v1/upload_resource.py
@@ -15,7 +15,7 @@
 
 from synapse.http.server import respond_with_json, request_handler
 
-from synapse.util.stringutils import random_string
+from synapse.util.stringutils import random_string, is_ascii
 from synapse.api.errors import SynapseError
 
 from twisted.web.server import NOT_DONE_YET
@@ -87,6 +87,8 @@ class UploadResource(BaseMediaResource):
         upload_name = request.args.get("filename", None)
         if upload_name:
             upload_name = upload_name[0]
+            if upload_name and not is_ascii(upload_name):
+                raise SynapseError(400, "filename must be ascii")
 
         headers = request.requestHeaders