diff options
| author | Michael Brown <michael@msbrown.net> | 2020-06-08 12:55:27 -0400 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2020-06-11 09:12:14 +0200 |
| commit | 45ec013116f5d3b9f6a626528e04276b78b688da (patch) | |
| tree | 5d3c4a50dd949876aa7ff1755e791ba71f066a0e | |
| parent | 4385ef0119c2e800f44ae92e3215cc8e571f6e7d (diff) | |
[3.1.x] Fixed #28132 -- Made MultiPartParser ignore filenames with trailing slash.
Backport of 36db4dd937ae11c5b687c5d2e5fa3c27e4140001 from master
| -rw-r--r-- | AUTHORS | 1 | ||||
| -rw-r--r-- | django/http/multipartparser.py | 2 | ||||
| -rw-r--r-- | tests/file_uploads/tests.py | 12 |
3 files changed, 11 insertions, 4 deletions
@@ -620,6 +620,7 @@ answer newbie questions, and generally made Django that much better: Maximillian Dornseif <md@hudora.de> mccutchen@gmail.com Meir Kriheli <http://mksoft.co.il/> + Michael S. Brown <michael@msbrown.net> Michael Hall <mhall1@ualberta.ca> Michael Josephson <http://www.sdjournal.com/> Michael Manfre <mmanfre@gmail.com> diff --git a/django/http/multipartparser.py b/django/http/multipartparser.py index 33d8814241..b3472f7be2 100644 --- a/django/http/multipartparser.py +++ b/django/http/multipartparser.py @@ -9,6 +9,7 @@ import binascii import cgi import collections import html +import os from urllib.parse import unquote from django.conf import settings @@ -208,6 +209,7 @@ class MultiPartParser: # This is a file, use the handler... file_name = disposition.get('filename') if file_name: + file_name = os.path.basename(file_name) file_name = force_str(file_name, encoding, errors='replace') file_name = self.IE_sanitize(html.unescape(file_name)) if not file_name: diff --git a/tests/file_uploads/tests.py b/tests/file_uploads/tests.py index 5743344a51..df8f1b8031 100644 --- a/tests/file_uploads/tests.py +++ b/tests/file_uploads/tests.py @@ -209,10 +209,14 @@ class FileUploadTests(TestCase): Receiving file upload when filename is blank (before and after sanitization) should be okay. """ - # The second value is normalized to an empty name by - # MultiPartParser.IE_sanitize() - filenames = ['', 'C:\\Windows\\'] - + filenames = [ + '', + # Normalized by MultiPartParser.IE_sanitize(). + 'C:\\Windows\\', + # Normalized by os.path.basename(). + '/', + 'ends-with-slash/', + ] payload = client.FakePayload() for i, name in enumerate(filenames): payload.write('\r\n'.join([ |