Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Discard empty upload_name before persisting file #7905

Merged
merged 14 commits into from
Sep 29, 2020
1 change: 1 addition & 0 deletions changelog.d/7905.bugfix
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fix synapse storing a media file with an invalid media_type or upload_name.
7 changes: 4 additions & 3 deletions synapse/rest/media/v1/media_repository.py
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
from twisted.web.resource import Resource

from synapse.api.errors import (
Codes,
FederationDeniedError,
HttpResponseException,
NotFoundError,
Expand Down Expand Up @@ -139,23 +140,23 @@ def mark_recently_accessed(self, server_name, media_id):
async def create_content(
self,
media_type: str,
upload_name: str,
upload_name: Optional[str],
content: IO,
content_length: int,
auth_user: str,
) -> str:
"""Store uploaded content for a local user and return the mxc URL

Args:
media_type: The content type of the file
upload_name: The name of the file
media_type(str): The content type of the file
clokep marked this conversation as resolved.
Show resolved Hide resolved
content: A file like object that is the content to store
content_length: The length of the content
auth_user: The user_id of the uploader

Returns:
The mxc url of the stored content
"""

media_id = random_string(24)

file_info = FileInfo(server_name=None, file_id=media_id)
Expand Down
4 changes: 4 additions & 0 deletions synapse/rest/media/v1/upload_resource.py
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,10 @@ async def _async_render_POST(self, request):
raise SynapseError(
msg="Invalid UTF-8 filename parameter: %r" % (upload_name), code=400
)

# upload_name might be an empty byte string
if len(upload_name) === 0:
clokep marked this conversation as resolved.
Show resolved Hide resolved
upload_name = None

headers = request.requestHeaders

Expand Down