mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2022-36359 -- Escaped filename in Content-Disposition header.

Browse Source 
Thanks to Motoyasu Saburi for the report.
This commit is contained in:
Carlton Gibson
2022-07-20 12:14:45 +02:00
parent 9062c23de8
commit bd062445cf
4 changed files with 52 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
tests/responses/test_fileresponse.py
View File

@@ -143,6 +143,41 @@ class FileResponseTests(SimpleTestCase):
'%s; filename="%s"' % (header_disposition, header_filename),
)
def test_content_disposition_escaping(self):
# fmt: off
tests = [
(
'multi-part-one";\" dummy".txt',
r"multi-part-one\";\" dummy\".txt"
),
]
# fmt: on
# Non-escape sequence backslashes are path segments on Windows, and are
# eliminated by an os.path.basename() check in FileResponse.
if sys.platform != "win32":
# fmt: off
tests += [
(
'multi-part-one\\";\" dummy".txt',
r"multi-part-one\\\";\" dummy\".txt"
),
(
'multi-part-one\\";\\\" dummy".txt',
r"multi-part-one\\\";\\\" dummy\".txt"
)
]
# fmt: on
for filename, escaped in tests:
with self.subTest(filename=filename, escaped=escaped):
response = FileResponse(
io.BytesIO(b"binary content"), filename=filename, as_attachment=True
)
response.close()
self.assertEqual(
response.headers["Content-Disposition"],
f'attachment; filename="{escaped}"',
)
def test_content_disposition_buffer(self):
response = FileResponse(io.BytesIO(b"binary content"))
self.assertFalse(response.has_header("Content-Disposition"))