Fix #3552: Upload filesize limits can be bypassed.

* Change `http_get_streaming` to write the output file directly,
  instead of taking a callback.

* Track the filesize as the download progresses and abort when it
  exceeds the limit.

* Don't save the Content-Type (it's not used anywhere).
This commit is contained in:
evazion
2018-02-17 15:06:49 -06:00
parent 7d5ad1bcc4
commit 5ad06a4034
2 changed files with 13 additions and 48 deletions

View File

@@ -37,21 +37,14 @@ module Downloads
should "retry three times" do
assert_raises(Errno::ETIMEDOUT) do
@download.http_get_streaming(@source) {}
@download.http_get_streaming(@source, @tempfile)
end
end
end
should "stream a file from an HTTP source" do
@download.http_get_streaming(@source) do |resp|
assert(resp.size > 0)
end
end
should "throw an exception when the file is larger than the maximum" do
assert_raise(Downloads::File::Error) do
@download.http_get_streaming(@source, {}, :max_size => 1) do |resp|
end
@download.http_get_streaming(@source, @tempfile, {}, max_size: 1)
end
end
@@ -61,29 +54,6 @@ module Downloads
assert(::File.exists?(@tempfile.path), "temp file should exist")
assert(::File.size(@tempfile.path) > 0, "should have data")
end
should "initialize the content type" do
@download.download!
assert_match(/image\/gif/, @download.content_type)
end
end
context "A post download with an HTTPS source" do
setup do
@source = "https://www.google.com/intl/en_ALL/images/logo.gif"
@tempfile = Tempfile.new("danbooru-test")
@download = Downloads::File.new(@source, @tempfile.path)
end
teardown do
@tempfile.close
end
should "stream a file from an HTTPS source" do
@download.http_get_streaming(@source) do |resp|
assert(resp.size > 0)
end
end
end
end
end