加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
CVE-2024-30251-PR-8332-482e6cdf-backport-3.9-Add-set_content_dispos.patch 2.93 KB
一键复制 编辑 原始数据 按行查看 历史
starlet_dx 提交于 2024-05-06 09:57 . Fix CVE-2024-30251
From 7eecdff163ccf029fbb1ddc9de4169d4aaeb6597 Mon Sep 17 00:00:00 2001
From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com>
Date: Mon, 15 Apr 2024 20:47:19 +0100
Subject: [PATCH] [PR #8332/482e6cdf backport][3.9] Add set_content_disposition
test (#8333)
**This is a backport of PR #8332 as merged into master
(482e6cdf6516607360666a48c5828d3dbe959fbd).**
Co-authored-by: Oleg A <t0rr@mail.ru>
---
CHANGES/8332.bugfix.rst | 1 +
aiohttp/multipart.py | 7 +++++--
tests/test_multipart.py | 7 +++++++
3 files changed, 13 insertions(+), 2 deletions(-)
create mode 100644 CHANGES/8332.bugfix.rst
diff --git a/CHANGES/8332.bugfix.rst b/CHANGES/8332.bugfix.rst
new file mode 100644
index 0000000000..70cad26b42
--- /dev/null
+++ b/CHANGES/8332.bugfix.rst
@@ -0,0 +1 @@
+Fixed regression with adding Content-Disposition to form-data part after appending to writer -- by :user:`Dreamsorcerer`/:user:`Olegt0rr`.
diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py
index a43ec54571..fcdf16183c 100644
--- a/aiohttp/multipart.py
+++ b/aiohttp/multipart.py
@@ -848,8 +848,6 @@ def append_payload(self, payload: Payload) -> Payload:
if self._is_form_data:
# https://datatracker.ietf.org/doc/html/rfc7578#section-4.7
# https://datatracker.ietf.org/doc/html/rfc7578#section-4.8
- assert CONTENT_DISPOSITION in payload.headers
- assert "name=" in payload.headers[CONTENT_DISPOSITION]
assert (
not {CONTENT_ENCODING, CONTENT_LENGTH, CONTENT_TRANSFER_ENCODING}
& payload.headers.keys()
@@ -930,6 +928,11 @@ def size(self) -> Optional[int]:
async def write(self, writer: Any, close_boundary: bool = True) -> None:
"""Write body."""
for part, encoding, te_encoding in self._parts:
+ if self._is_form_data:
+ # https://datatracker.ietf.org/doc/html/rfc7578#section-4.2
+ assert CONTENT_DISPOSITION in part.headers
+ assert "name=" in part.headers[CONTENT_DISPOSITION]
+
await writer.write(b"--" + self._boundary + b"\r\n")
await writer.write(part._binary_headers)
diff --git a/tests/test_multipart.py b/tests/test_multipart.py
index dbfaf74b9b..37ac54797f 100644
--- a/tests/test_multipart.py
+++ b/tests/test_multipart.py
@@ -1282,6 +1282,13 @@ def test_append_multipart(self, writer) -> None:
part = writer._parts[0][0]
assert part.headers[CONTENT_TYPE] == "test/passed"
+ async def test_set_content_disposition_after_append(self):
+ writer = aiohttp.MultipartWriter("form-data")
+ payload = writer.append("some-data")
+ payload.set_content_disposition("form-data", name="method")
+ assert CONTENT_DISPOSITION in payload.headers
+ assert "name=" in payload.headers[CONTENT_DISPOSITION]
+
def test_with(self) -> None:
with aiohttp.MultipartWriter(boundary=":") as writer:
writer.append("foo")
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化