Validate the Content-Type on PUT requests
Return a 415 (https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/415) when the Content-Type does not look like a valid MIME type (in the type/subtype format) Refs #137
This commit is contained in:
@@ -506,5 +506,10 @@ module RemoteStorage
|
||||
items
|
||||
end
|
||||
|
||||
def validate_content_type(content_type)
|
||||
# Do not try to perform the PUT request when the Content-Type does not
|
||||
# look like a MIME type
|
||||
server.halt 415 unless content_type.match(/^.+\/.+/i)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
@@ -16,6 +16,8 @@ module RemoteStorage
|
||||
end
|
||||
|
||||
def do_put_request(url, data, content_type)
|
||||
validate_content_type(content_type)
|
||||
|
||||
deal_with_unauthorized_requests do
|
||||
md5 = Digest::MD5.base64digest(data)
|
||||
authorization_headers = authorization_headers_for(
|
||||
|
||||
Reference in New Issue
Block a user