Validate the Content-Type on PUT requests
Return a 415 (https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/415) when the Content-Type does not look like a valid MIME type (in the type/subtype format) Refs #137
This commit is contained in:
parent
ab673f1d43
commit
71d138894e
@ -506,5 +506,10 @@ module RemoteStorage
|
|||||||
items
|
items
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def validate_content_type(content_type)
|
||||||
|
# Do not try to perform the PUT request when the Content-Type does not
|
||||||
|
# look like a MIME type
|
||||||
|
server.halt 415 unless content_type.match(/^.+\/.+/i)
|
||||||
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
@ -16,6 +16,8 @@ module RemoteStorage
|
|||||||
end
|
end
|
||||||
|
|
||||||
def do_put_request(url, data, content_type)
|
def do_put_request(url, data, content_type)
|
||||||
|
validate_content_type(content_type)
|
||||||
|
|
||||||
deal_with_unauthorized_requests do
|
deal_with_unauthorized_requests do
|
||||||
md5 = Digest::MD5.base64digest(data)
|
md5 = Digest::MD5.base64digest(data)
|
||||||
authorization_headers = authorization_headers_for(
|
authorization_headers = authorization_headers_for(
|
||||||
|
@ -232,6 +232,16 @@ shared_examples_for 'a REST adapter' do
|
|||||||
_(last_response.body).must_equal "Precondition Failed"
|
_(last_response.body).must_equal "Precondition Failed"
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
describe "Content-Type" do
|
||||||
|
it "must be in the type/subtype format" do
|
||||||
|
header "Content-Type", "text"
|
||||||
|
|
||||||
|
put "/phil/food/invalid_content_type", "invalid"
|
||||||
|
|
||||||
|
_(last_response.status).must_equal 415
|
||||||
|
end
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
end
|
end
|
||||||
|
Loading…
x
Reference in New Issue
Block a user