Skip to content

Commit 51163e9

Browse files
committed
added invalid suffix check to ldp and test in http-test
1 parent 4becb86 commit 51163e9

File tree

2 files changed

+11
-0
lines changed

2 files changed

+11
-0
lines changed

lib/ldp.js

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,11 +148,15 @@ class LDP {
148148
// prepare slug
149149
if (slug) {
150150
if (this.isAuxResource(slug, extension)) throw error(403, 'POST is not allowed for auxiliary resources')
151+
if (this._containsInvalidSuffixes(slug)) {
152+
throw error(400, `${slug} is an invalid file path`)
153+
}
151154
slug = decodeURIComponent(slug)
152155
if (slug.match(/\/|\||:/)) {
153156
throw error(400, 'The name of new file POSTed may not contain : | or /')
154157
}
155158
}
159+
156160
// Containers should not receive an extension
157161
if (container) {
158162
extension = ''

test/integration/http-test.js

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -891,6 +891,13 @@ describe('HTTP APIs', function () {
891891
.set('content-type', 'text/turtle')
892892
.expect(403, done)
893893
})
894+
it('should error with 400 if slug contains invalid suffix', function (done) {
895+
server.post('/post-tests/')
896+
.set('slug', 'put-resource.acl.ttl')
897+
.send(postRequest1Body)
898+
.set('content-type', 'text-turtle')
899+
.expect(400, done)
900+
})
894901
it('should error with 400 if the body is empty and no content type is provided', function (done) {
895902
server.post('/post-tests/')
896903
.set('slug', 'post-resource-empty-fail')

0 commit comments

Comments
 (0)