Validate the Content-Type on PUT requests

Return a 415
(https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/415) when the
Content-Type does not look like a valid MIME type (in the type/subtype
format)

Refs #137
This commit is contained in:
Greg Karékinian 2020-04-15 13:45:34 +02:00
parent ab673f1d43
commit 71d138894e
3 changed files with 17 additions and 0 deletions

View File

@ -506,5 +506,10 @@ module RemoteStorage
items items
end end
def validate_content_type(content_type)
# Do not try to perform the PUT request when the Content-Type does not
# look like a MIME type
server.halt 415 unless content_type.match(/^.+\/.+/i)
end
end end
end end

View File

@ -16,6 +16,8 @@ module RemoteStorage
end end
def do_put_request(url, data, content_type) def do_put_request(url, data, content_type)
validate_content_type(content_type)
deal_with_unauthorized_requests do deal_with_unauthorized_requests do
md5 = Digest::MD5.base64digest(data) md5 = Digest::MD5.base64digest(data)
authorization_headers = authorization_headers_for( authorization_headers = authorization_headers_for(

View File

@ -232,6 +232,16 @@ shared_examples_for 'a REST adapter' do
_(last_response.body).must_equal "Precondition Failed" _(last_response.body).must_equal "Precondition Failed"
end end
end end
describe "Content-Type" do
it "must be in the type/subtype format" do
header "Content-Type", "text"
put "/phil/food/invalid_content_type", "invalid"
_(last_response.status).must_equal 415
end
end
end end
end end