diff options
| author | Richard van der Hoff <richard@matrix.org> | 2019-11-05 15:45:17 +0000 |
|---|---|---|
| committer | Richard van der Hoff <richard@matrix.org> | 2019-11-05 15:51:18 +0000 |
| commit | e9bfe719ba1928dc191cea93120c5c8a89584434 (patch) | |
| tree | 7599dfacc74276cab53c2cef2ff38b31df6922d2 /tests/rest/media/v1 | |
| parent | 1.5.0 (diff) | |
| download | synapse-e9bfe719ba1928dc191cea93120c5c8a89584434.tar.xz | |
Strip overlong OpenGraph data from url preview
... to stop people causing DoSes with malicious web pages
Diffstat (limited to 'tests/rest/media/v1')
| -rw-r--r-- | tests/rest/media/v1/test_url_preview.py | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/tests/rest/media/v1/test_url_preview.py b/tests/rest/media/v1/test_url_preview.py index 976652aee8..da19a8e86f 100644 --- a/tests/rest/media/v1/test_url_preview.py +++ b/tests/rest/media/v1/test_url_preview.py @@ -247,6 +247,40 @@ class URLPreviewTests(unittest.HomeserverTestCase): self.assertEqual(channel.code, 200) self.assertEqual(channel.json_body["og:title"], "\u0434\u043a\u0430") + def test_overlong_title(self): + self.lookups["matrix.org"] = [(IPv4Address, "8.8.8.8")] + + end_content = ( + b"<html><head>" + b"<title>" + b"x" * 2000 + b"</title>" + b'<meta property="og:description" content="hi" />' + b"</head></html>" + ) + + request, channel = self.make_request( + "GET", "url_preview?url=http://matrix.org", shorthand=False + ) + request.render(self.preview_url) + self.pump() + + client = self.reactor.tcpClients[0][2].buildProtocol(None) + server = AccumulatingProtocol() + server.makeConnection(FakeTransport(client, self.reactor)) + client.makeConnection(FakeTransport(server, self.reactor)) + client.dataReceived( + ( + b"HTTP/1.0 200 OK\r\nContent-Length: %d\r\n" + b'Content-Type: text/html; charset="windows-1251"\r\n\r\n' + ) + % (len(end_content),) + + end_content + ) + + self.pump() + self.assertEqual(channel.code, 200) + res = channel.json_body + self.assertCountEqual(["og:description"], res.keys()) + def test_ipaddr(self): """ IP addresses can be previewed directly. |