github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-28 13:51:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Safely decompress files. (#8124)

Browse Source 
* FEATURE: Adds an extra protection layer when decompressing files.

* Rename exporter/importer to zip importer. Update old locale

* Added a new composite class to decompress a file with multiple strategies

* Set max file size inside a site setting

* Ensure that file is deleted after compression

* Sanitize path and files before compressing/decompressing
This commit is contained in:
Roman Rizzi
2019-10-03 10:19:35 -03:00
committed by GitHub
parent aaf15944f8
commit 10565e4623
20 changed files with 466 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spec/requests/admin/themes_controller_spec.rb
View File

@ -50,7 +50,7 @@ describe Admin::ThemesController do
expect(response.status).to eq(200)
# Save the output in a temp file (automatically cleaned up)
file = Tempfile.new('archive.tar.zip')
file = Tempfile.new('archive.zip')
file.write(response.body)
file.rewind
uploaded_file = Rack::Test::UploadedFile.new(file.path, "application/zip")