[pve-devel] [PATCH http-server v2 1/2] upload: allow whitespaces in filenames

[pve-devel] [PATCH http-server v2 1/2] upload: allow whitespaces in filenames

[Dominik Csapak]

some fields (e.g. filename) can contain spaces, but our 'trim' function,
would only return the value until the first whitespace character instead
of removing leading/trailing white space. this lead to giving the wrong
filename to the api call (e.g. 'foo' instead of 'foo (1).iso') which
would reject it because of the 'wrong' extension

this patch fixes that by using trim from pve-common

fixes commit:
0fbcbc2 ("fix #3990: multipart upload: rework to fix uploading small files")

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 src/PVE/APIServer/AnyEvent.pm | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index 4296ded..39061ad 100644
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -46,7 +46,7 @@ use URI;
 
 use PVE::INotify;
 use PVE::SafeSyslog;
-use PVE::Tools;
+use PVE::Tools qw(trim);
 
 use PVE::APIServer::Formatter;
 use PVE::APIServer::Utils;
@@ -1186,11 +1186,6 @@ my sub assert_form_disposition {
 sub file_upload_multipart {
     my ($self, $reqstate, $auth, $method, $path, $rstate) = @_;
 
-    my $trim = sub {
-	$_[0] =~ /\s*(\S+)/;
-	return $1;
-    };
-
     eval {
 	my $boundary = $rstate->{boundary};
 	my $hdl = $reqstate->{hdl};
@@ -1210,7 +1205,7 @@ sub file_upload_multipart {
 	    my ($name) = @_;
 	    if ($hdl->{rbuf} =~ s/^${delim_re}Content-Disposition: (.*?); name="$name"(.*?)($delim_re)/$3/s) {
 		assert_form_disposition($1);
-		$rstate->{params}->{$name} = $trim->($2);
+		$rstate->{params}->{$name} = trim($2);
 	    }
 	};
 
@@ -1228,7 +1223,7 @@ sub file_upload_multipart {
 		assert_form_disposition($1);
 		die "wrong field name '$2' for file upload, expected 'filename'" if $2 ne "filename";
 		$rstate->{phase} = 2;
-		$rstate->{params}->{filename} = $trim->($3);
+		$rstate->{params}->{filename} = trim($3);
 	    }
 	}
 
-- 
2.30.2

[pve-devel] [PATCH http-server v2 2/2] remove dead code 'parse_content_disposition'

[Dominik Csapak]

our recent change to parsing the upload headers made that code
unnecessary, so remove it

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 src/PVE/APIServer/AnyEvent.pm | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index 39061ad..f397a8c 100644
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -1280,26 +1280,6 @@ sub parse_content_type {
     return  wantarray ? ($ct) : $ct;
 }
 
-sub parse_content_disposition {
-    my ($line) = @_;
-
-    my ($disp, @params) = split(/\s*[;,]\s*/o, $line);
-    my $name;
-    my $filename;
-
-    foreach my $v (@params) {
-	if ($v =~ m/^\s*name\s*=\s*(\S+?)\s*$/o) {
-	    $name = $1;
-	    $name =~ s/^"(.*)"$/$1/;
-	} elsif ($v =~ m/^\s*filename\s*=\s*(.+?)\s*$/o) {
-	    $filename = $1;
-	    $filename =~ s/^"(.*)"$/$1/;
-	}
-    }
-
-    return  wantarray ? ($disp, $name, $filename) : $disp;
-}
-
 my $tmpfile_seq_no = 0;
 
 sub get_upload_filename {
-- 
2.30.2

[pve-devel] applied: [PATCH http-server v2 1/2] upload: allow whitespaces in filenames

[Thomas Lamprecht]

Am 07/11/2022 um 16:07 schrieb Dominik Csapak:
> some fields (e.g. filename) can contain spaces, but our 'trim' function,
> would only return the value until the first whitespace character instead
> of removing leading/trailing white space. this lead to giving the wrong
> filename to the api call (e.g. 'foo' instead of 'foo (1).iso') which
> would reject it because of the 'wrong' extension
> 
> this patch fixes that by using trim from pve-common
> 
> fixes commit:
> 0fbcbc2 ("fix #3990: multipart upload: rework to fix uploading small files")
> 
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
>  src/PVE/APIServer/AnyEvent.pm | 11 +++--------
>  1 file changed, 3 insertions(+), 8 deletions(-)
> 
>

applied, thanks!

[pve-devel] applied: [PATCH http-server v2 2/2] remove dead code 'parse_content_disposition'

[Thomas Lamprecht]

Am 07/11/2022 um 16:07 schrieb Dominik Csapak:
> our recent change to parsing the upload headers made that code
> unnecessary, so remove it
> 
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
>  src/PVE/APIServer/AnyEvent.pm | 20 --------------------
>  1 file changed, 20 deletions(-)
> 
>

applied, thanks!