/media/:id endpoint can error with controlled characters #261

New Issue

Open

opened 2022-11-10 03:49:53 +00:00 by floatingghost · 0 comments

floatingghost commented

2022-11-10 03:49:53 +00:00

Owner

note to self

from logs

1107851]: Request: GET /media/somehash.mp4?name=fname%0A
1107851]: ** (exit) an exception was raised:
1107851]:     ** (Plug.Conn.InvalidHeaderError) value for header "content-disposition" contains control feed (\r) or newline (\n): "filename=\"fname\n\""
1107851]:         (plug 1.10.4) lib/plug/conn.ex:1755: Plug.Conn.validate_header_value!/2
1107851]:         (plug 1.10.4) lib/plug/conn.ex:779: Plug.Conn.put_resp_header/3
1107851]:         (pleroma 3.3.1-75-g7eda5f8a-develop) lib/pleroma/web/plugs/uploaded_media.ex:40: Pleroma.Web.Plugs.UploadedMedia.call/2
1107851]:         (pleroma 3.3.1-75-g7eda5f8a-develop) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.plug_builder_call/2

we should probably catch this

note to self from logs ``` 1107851]: Request: GET /media/somehash.mp4?name=fname%0A 1107851]: ** (exit) an exception was raised: 1107851]: ** (Plug.Conn.InvalidHeaderError) value for header "content-disposition" contains control feed (\r) or newline (\n): "filename=\"fname\n\"" 1107851]: (plug 1.10.4) lib/plug/conn.ex:1755: Plug.Conn.validate_header_value!/2 1107851]: (plug 1.10.4) lib/plug/conn.ex:779: Plug.Conn.put_resp_header/3 1107851]: (pleroma 3.3.1-75-g7eda5f8a-develop) lib/pleroma/web/plugs/uploaded_media.ex:40: Pleroma.Web.Plugs.UploadedMedia.call/2 1107851]: (pleroma 3.3.1-75-g7eda5f8a-develop) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.plug_builder_call/2 ``` we should probably catch this

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: AkkomaGang/akkoma#261

No description provided.