diff options
author | Patrik Ragnarsson <patrik@starkast.net> | 2023-04-25 03:41:12 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-04-25 13:41:12 +1200 |
commit | ccd445d7de85c4d5771e860add87104258b16f01 (patch) | |
tree | 803ea902b876fa4400d5ca5496ef4ab71fc0b11e /test/spec_multipart.rb | |
parent | f5666bc8cb13b8d731ea0222fbd3ada670f2cd55 (diff) | |
download | rack-ccd445d7de85c4d5771e860add87104258b16f01.tar.gz |
Limit file extension length of multipart tempfiles (#2069)
- Fixes #1968
Diffstat (limited to 'test/spec_multipart.rb')
-rw-r--r-- | test/spec_multipart.rb | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/test/spec_multipart.rb b/test/spec_multipart.rb index 48d03e43..d5ebe717 100644 --- a/test/spec_multipart.rb +++ b/test/spec_multipart.rb @@ -780,6 +780,28 @@ contents\r params["file"][:filename].must_equal 'long' * 100 end + it "limits very long file name extensions in multipart tempfiles" do + data = <<-EOF +--AaB03x\r +content-type: text/plain\r +content-disposition: attachment; name=file; filename=foo.#{'a' * 1000}\r +\r +contents\r +--AaB03x--\r + EOF + + options = { + "CONTENT_TYPE" => "multipart/form-data; boundary=AaB03x", + "CONTENT_LENGTH" => data.length.to_s, + :input => StringIO.new(data) + } + env = Rack::MockRequest.env_for("/", options) + params = Rack::Multipart.parse_multipart(env) + + params["file"][:filename].must_equal "foo.#{'a' * 1000}" + File.extname(env["rack.tempfiles"][0]).must_equal ".#{'a' * 128}" + end + it "parse unquoted parameter values at end of line" do data = <<-EOF --AaB03x\r |