python-aiohttp/CVE-2024-30251-Followup-02.patch

63 lines
2.6 KiB
Diff
Raw Permalink Normal View History

From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
Date: Mon, 15 Apr 2024 21:54:12 +0100
Subject: Add Content-Disposition automatically (#8336)
**This is a backport of PR #8335 as merged into master
(5a6949da642d1db6cf414fd0d1f70e54c7b7be14).**
Co-authored-by: Sam Bull <git@sambull.org>
---
aiohttp/multipart.py | 4 ++++
tests/test_multipart.py | 22 +++++++++++++++++-----
2 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py
index ac7dfdb..ac7a459 100644
--- a/aiohttp/multipart.py
+++ b/aiohttp/multipart.py
@@ -845,6 +845,10 @@ class MultipartWriter(Payload):
not {CONTENT_ENCODING, CONTENT_LENGTH, CONTENT_TRANSFER_ENCODING}
& payload.headers.keys()
)
+ # Set default Content-Disposition in case user doesn't create one
+ if CONTENT_DISPOSITION not in payload.headers:
+ name = f"section-{len(self._parts)}"
+ payload.set_content_disposition("form-data", name=name)
else:
# compression
encoding = payload.headers.get(CONTENT_ENCODING, "").lower()
diff --git a/tests/test_multipart.py b/tests/test_multipart.py
index 89db7f8..cff9c08 100644
--- a/tests/test_multipart.py
+++ b/tests/test_multipart.py
@@ -1122,12 +1122,24 @@ class TestMultipartWriter:
part = writer._parts[0][0]
assert part.headers[CONTENT_TYPE] == "test/passed"
- async def test_set_content_disposition_after_append(self):
+ def test_set_content_disposition_after_append(self):
writer = aiohttp.MultipartWriter("form-data")
- payload = writer.append("some-data")
- payload.set_content_disposition("form-data", name="method")
- assert CONTENT_DISPOSITION in payload.headers
- assert "name=" in payload.headers[CONTENT_DISPOSITION]
+ part = writer.append("some-data")
+ part.set_content_disposition("form-data", name="method")
+ assert 'name="method"' in part.headers[CONTENT_DISPOSITION]
+
+ def test_automatic_content_disposition(self):
+ writer = aiohttp.MultipartWriter("form-data")
+ writer.append_json(())
+ part = payload.StringPayload("foo")
+ part.set_content_disposition("form-data", name="second")
+ writer.append_payload(part)
+ writer.append("foo")
+
+ disps = tuple(p[0].headers[CONTENT_DISPOSITION] for p in writer._parts)
+ assert 'name="section-0"' in disps[0]
+ assert 'name="second"' in disps[1]
+ assert 'name="section-2"' in disps[2]
def test_with(self) -> None:
with aiohttp.MultipartWriter(boundary=":") as writer: