From bab1ab5b6c74de5f02d9ddd06f0026efa547c2a5 Mon Sep 17 00:00:00 2001
From: FloatingGhost <hannah@coffee-and-dreams.uk>
Date: Thu, 10 Nov 2022 11:54:12 +0000
Subject: [PATCH] strip \r and \r from content-disposition filenames

---
 lib/pleroma/web/plugs/uploaded_media.ex             |  9 ++++++++-
 test/pleroma/web/plugs/uploaded_media_plug_test.exs | 11 +++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/pleroma/web/plugs/uploaded_media.ex b/lib/pleroma/web/plugs/uploaded_media.ex
index 7b87d8f17..72f20e8de 100644
--- a/lib/pleroma/web/plugs/uploaded_media.ex
+++ b/lib/pleroma/web/plugs/uploaded_media.ex
@@ -35,7 +35,7 @@ def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
     conn =
       case fetch_query_params(conn) do
         %{query_params: %{"name" => name}} = conn ->
-          name = String.replace(name, "\"", "\\\"")
+          name = escape_header_value(name)
 
           put_resp_header(conn, "content-disposition", "filename=\"#{name}\"")
 
@@ -98,4 +98,11 @@ defp get_media(conn, unknown, _) do
     |> send_resp(:internal_server_error, dgettext("errors", "Internal Error"))
     |> halt()
   end
+
+  defp escape_header_value(value) do
+    value
+    |> String.replace("\"", "\\\"")
+    |> String.replace("\\r", "")
+    |> String.replace("\\n", "")
+  end
 end
diff --git a/test/pleroma/web/plugs/uploaded_media_plug_test.exs b/test/pleroma/web/plugs/uploaded_media_plug_test.exs
index 75f313282..c71a7e789 100644
--- a/test/pleroma/web/plugs/uploaded_media_plug_test.exs
+++ b/test/pleroma/web/plugs/uploaded_media_plug_test.exs
@@ -40,4 +40,15 @@ test "sends Content-Disposition header when name param is set", %{
              &(&1 == {"content-disposition", "filename=\"\\\"cofe\\\".gif\""})
            )
   end
+
+  test "removes control characters from the Content-Disposition header", %{
+    attachment_url: attachment_url
+  } do
+    conn = get(build_conn(), attachment_url <> "?name=\"cofe\".gif\\r\\n")
+
+    assert Enum.any?(
+             conn.resp_headers,
+             &(&1 == {"content-disposition", "filename=\"\\\"cofe\\\".gif\""})
+           )
+  end
 end