do not forget the filename in those multipart spoofs

This commit is contained in:
HoneyryderChuck 2021-05-27 17:44:28 +01:00
parent 357344f2f9
commit c61007ba0f
3 changed files with 6 additions and 4 deletions

View File

@ -26,7 +26,7 @@ module HTTPX
content_type ||= MimeTypeDetector.call(value, filename) || "application/octet-stream" content_type ||= MimeTypeDetector.call(value, filename) || "application/octet-stream"
[value, content_type, filename] [value, content_type, filename]
else else
[StringIO.new(value.to_s), content_type || "text/plain"] [StringIO.new(value.to_s), content_type || "text/plain", filename]
end end
end end
end end

View File

@ -33,7 +33,7 @@ module HTTPX
end end
module Part module Part
def self?.call: (multipart_nested_value) -> ([_Reader, String, String?] | [_Reader, String]) def self?.call: (multipart_nested_value) -> ([_Reader, String, String?])
end end
module MimeTypeDetector module MimeTypeDetector

View File

@ -174,7 +174,7 @@ module Requests
body = json_body(response) body = json_body(response)
verify_header(body["headers"], "Content-Type", "multipart/form-data") verify_header(body["headers"], "Content-Type", "multipart/form-data")
# httpbin accepts the spoofed part, but it wipes our the content-type header # httpbin accepts the spoofed part, but it wipes our the content-type header
verify_uploaded(body, "form", "image" => "spoofpeg") verify_uploaded_image(body, "image", "spoofpeg", skip_verify_data: true)
end end
end end
@ -209,10 +209,12 @@ module Requests
File.join("test", "support", "fixtures", fixture_file_name) File.join("test", "support", "fixtures", fixture_file_name)
end end
def verify_uploaded_image(body, key, mime_type) def verify_uploaded_image(body, key, mime_type, skip_verify_data: false)
assert body.key?("files"), "there were no files uploaded" assert body.key?("files"), "there were no files uploaded"
assert body["files"].key?(key), "there is no image in the file" assert body["files"].key?(key), "there is no image in the file"
# checking mime-type is a bit leaky, as httpbin displays the base64-encoded data # checking mime-type is a bit leaky, as httpbin displays the base64-encoded data
return if skip_verify_data
assert body["files"][key].start_with?("data:#{mime_type}"), "data was wrongly encoded (#{body["files"][key][0..64]})" assert body["files"][key].start_with?("data:#{mime_type}"), "data was wrongly encoded (#{body["files"][key][0..64]})"
end end
end end