diff options
| -rw-r--r-- | lib/rack/multipart/parser.rb | 4 | ||||
| -rw-r--r-- | test/spec_multipart.rb | 22 |
2 files changed, 25 insertions, 1 deletions
diff --git a/lib/rack/multipart/parser.rb b/lib/rack/multipart/parser.rb index 0fc18560..f981a7fa 100644 --- a/lib/rack/multipart/parser.rb +++ b/lib/rack/multipart/parser.rb @@ -13,7 +13,9 @@ module Rack BUFSIZE = 1_048_576 TEXT_PLAIN = "text/plain" TEMPFILE_FACTORY = lambda { |filename, content_type| - Tempfile.new(["RackMultipart", ::File.extname(filename.gsub("\0", '%00'))]) + extension = ::File.extname(filename.gsub("\0", '%00'))[0, 129] + + Tempfile.new(["RackMultipart", extension]) } BOUNDARY_REGEX = /\A([^\n]*(?:\n|\Z))/ diff --git a/test/spec_multipart.rb b/test/spec_multipart.rb index d5bf30d3..dcc004da 100644 --- a/test/spec_multipart.rb +++ b/test/spec_multipart.rb @@ -704,6 +704,28 @@ contents\r params["file"][:filename].must_equal 'long' * 100 end + it "limits very long file name extensions in multipart tempfiles" do + data = <<-EOF +--AaB03x\r +content-type: text/plain\r +content-disposition: attachment; name=file; filename=foo.#{'a' * 1000}\r +\r +contents\r +--AaB03x--\r + EOF + + options = { + "CONTENT_TYPE" => "multipart/form-data; boundary=AaB03x", + "CONTENT_LENGTH" => data.length.to_s, + :input => StringIO.new(data) + } + env = Rack::MockRequest.env_for("/", options) + params = Rack::Multipart.parse_multipart(env) + + params["file"][:filename].must_equal "foo.#{'a' * 1000}" + File.extname(env["rack.tempfiles"][0]).must_equal ".#{'a' * 128}" + end + it "parse unquoted parameter values at end of line" do data = <<-EOF --AaB03x\r |