Changeset 8068f6d

Timestamp:

Sep 8, 2012, 6:59:18 PM (13 years ago)

Author:

Alex Dehnert <adehnert@…>

Branches:

master, space-access, stable, stage

Children:

2e5dc1b

Parents:

26fd6cf

git-author:

Alex Dehnert <adehnert@…> (09/08/12 17:13:36)

git-committer:

Alex Dehnert <adehnert@…> (09/08/12 18:59:18)

Message:

Limit and canonicalize constitution file extensions

This makes it plausibly safe to serve the directory containing the
constitutions from a web server that supports PHP or CGI or whatnot. However,
note that HTML (and other file contents) isn't sanitized at all, so serving
them up on an origin you care about (eg, ​https://asa.mit.edu/constitutions/...)
would be quite ill-advised.

File:

• asadb/groups/models.py (modified) (2 diffs)

asadb/groups/models.py

@@ -183 +183 @@
     def compute_filename(self, tmp_path, headers, ):
         slug = self.group.slug()
+        known_ext = set([
+            '.pdf',
+            '.ps',
+            '.doc',
+            '.rtf',
+            '.html',
+            '.tex',
+            '.txt'
+        ])
         basename, fileext = os.path.splitext(tmp_path)
         if fileext:
@@ -188 +197 @@
         else:
             if headers.getheader('Content-Type'):
-                mimeext = mimetypes.guess_extension(headers.gettype())
-                if mimeext:
-                    ext = mimeext
+                extensions = mimetypes.guess_all_extensions(headers.gettype())
+                for extension in extensions:
+                    if extension in known_ext:
+                        ext = extension
+                        break
                 else:
-                    ext = ''
+                    if len(extensions) > 0:
+                        ext = extensions[0]
+                    else:
+                        ext = ''
             else:
                 ext = ''
+
+        extmap = {
+            '.htm': '.html',
+            '.php': '.html',
+            '.PS':  '.ps',
+            '.shtml':   '.html',
+            '.text':    '.txt',
+        }
+        # we have no real handling of no extension, .old, and .ksh
+        if ext in extmap: ext = extmap[ext]
+        if ext not in known_ext: ext = ext + '.unknown'
+
         return "%04d-%s%s" % (self.group.pk, slug, ext, )