0001-general-blacklist-some-file-types-for-upload-6829.patch

Frédéric Péters, 25 janvier 2020 16:50

Voir les différences: en ligne côte à côte

Subject: [PATCH] general: blacklist some file types for upload (#6829)

 tests/test_form_pages.py | 40 ++++++++++++++++++++++++++++++++++++++++
 wcs/qommon/form.py       | 10 ++++++++++
 2 files changed, 50 insertions(+)

         assert resp.text == '%PDF-1.4 ...'
     def test_form_file_field_submit_blacklist(pub):
         formdef = create_formdef()
         formdef.fields = [fields.FileField(id='0', label='file')]
         formdef.store()
         formdef.data_class().wipe()
         # application/x-ms-dos-executable
         upload = Upload('test.exe', b'MZ...', 'application/force-download')
         resp = get_app(pub).get('/test/')
         resp.forms[0]['f0$file'] = upload
         resp = resp.forms[0].submit('submit')
         assert 'forbidden file type' in resp.text
         # define custom blacklist
         pub.load_site_options()
         if not pub.site_options.has_section('options'):
             pub.site_options.add_section('options')
         pub.site_options.set('options', 'blacklisted-file-types', 'application/pdf')
         with open(os.path.join(pub.app_dir, 'site-options.cfg'), 'w') as fd:
             pub.site_options.write(fd)
         # check against mime type
         upload = Upload('test.pdf', b'%PDF-1.4 ...', 'application/force-download')
         resp = get_app(pub).get('/test/')
         resp.forms[0]['f0$file'] = upload
         resp = resp.forms[0].submit('submit')
         assert 'forbidden file type' in resp.text
         # check against extension
         pub.site_options.set('options', 'blacklisted-file-types', '.pdf')
         with open(os.path.join(pub.app_dir, 'site-options.cfg'), 'w') as fd:
             pub.site_options.write(fd)
         upload = Upload('test.pdf', b'%PDF-1.4 ...', 'application/force-download')
         resp = get_app(pub).get('/test/')
         resp.forms[0]['f0$file'] = upload
         resp = resp.forms[0].submit('submit')
         assert 'forbidden file type' in resp.text
     def test_form_table_field_submit(pub, emails):
         formdef = create_formdef()
         formdef.fields = [fields.TableField(id='0', label='table', type='table',

                 if not valid_file_type:
                     self.error = _('invalid file type')
             blacklisted_file_types = get_publisher().get_site_option('blacklisted-file-types')
             if blacklisted_file_types:
                 blacklisted_file_types = [x.strip() for x in blacklisted_file_types.split(',')]
             else:
                 blacklisted_file_types = ['.exe', '.bat', '.com', '.pif', '.php', '.js',
                         'application/x-ms-dos-executable']
             if (os.path.splitext(self.value.base_filename)[-1] in blacklisted_file_types or
                     filetype in blacklisted_file_types):
                 self.error = _('forbidden file type')
     class PicklableUpload(Upload):
         def __getstate__(self):
+    -

Projet

Général

Profil

Produits Entr'ouvert » w.c.s.

0001-general-blacklist-some-file-types-for-upload-6829.patch