diff options
author | Hrushikesh Vaidya <hrushikeshrv@gmail.com> | 2022-01-17 14:42:48 +0530 |
---|---|---|
committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2022-01-20 07:19:52 +0100 |
commit | 3fadf141e66c8d0baaa66574fa3b63c4d3655482 (patch) | |
tree | fb04627e74070eb488e6efb35af4f1d4d32e1909 /tests/file_uploads | |
parent | 0f6946495a8ec955b471ca1baaf408ceb53d4796 (diff) | |
download | django-3fadf141e66c8d0baaa66574fa3b63c4d3655482.tar.gz |
Fixed #33062 -- Made MultiPartParser remove non-printable chars from file names.
Diffstat (limited to 'tests/file_uploads')
-rw-r--r-- | tests/file_uploads/tests.py | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/tests/file_uploads/tests.py b/tests/file_uploads/tests.py index 145d714a76..1e20b48d25 100644 --- a/tests/file_uploads/tests.py +++ b/tests/file_uploads/tests.py @@ -283,6 +283,29 @@ class FileUploadTests(TestCase): for i, name in enumerate(filenames): self.assertIsNone(received.get('file%s' % i)) + def test_non_printable_chars_in_file_names(self): + file_name = 'non-\x00printable\x00\n_chars.txt\x00' + payload = client.FakePayload() + payload.write('\r\n'.join([ + '--' + client.BOUNDARY, + f'Content-Disposition: form-data; name="file"; filename="{file_name}"', + 'Content-Type: application/octet-stream', + '', + 'You got pwnd.\r\n' + ])) + payload.write('\r\n--' + client.BOUNDARY + '--\r\n') + r = { + 'CONTENT_LENGTH': len(payload), + 'CONTENT_TYPE': client.MULTIPART_CONTENT, + 'PATH_INFO': '/echo/', + 'REQUEST_METHOD': 'POST', + 'wsgi.input': payload, + } + response = self.client.request(**r) + # Non-printable chars are sanitized. + received = response.json() + self.assertEqual(received['file'], 'non-printable_chars.txt') + def test_dangerous_file_names(self): """Uploaded file names should be sanitized before ever reaching the view.""" # This test simulates possible directory traversal attacks by a |