Summary

Don't trust the browser-provided mimetype if it looks bogus.

Review Request #6118 — Created July 19, 2014 and submitted July 19, 2014, 10:47 p.m.

Information

Owner

david

Repository

Review Board

Branch

release-2.0.x

Bugs

3427

Depends On

Commit

d1d8ec2...

Reviewers

Groups

reviewboard

People

Description

A user was reporting that their PDF file uploads were being assigned the
mimetype of "text/text/application/pdf", which is completely bogus. If
splitting on '/' produces anything other than a list of two strings, don't
allow it to proceed.

Testing Done

Ran unit tests.

Issues

Description	From	Last Updated
Shouldn't this be blah.split('/') != 2, instead of using not .. ==?	chipx86	July 19, 2014, 12:52 p.m.
Can we add a comment above this conditional talking about this, and referencing the bug? It's obscure enough that I …	chipx86	July 19, 2014, 3:21 p.m.

Tool: PEP8 Style Checker
Processed Files:
    reviewboard/attachments/forms.py



Tool: Pyflakes
Processed Files:
    reviewboard/attachments/forms.py

reviewboard/attachments/forms.py (Diff revision 1)
The issue has been resolved. Show all issues
```
Shouldn't this be blah.split('/') != 2, instead of using not .. ==?
```

Commit:

cb4bd75c1878cd5d8eddaf010e26a2f2b69a8293

9babf6f8c1312aac937622c62d0b88f974519969

Diff:

Revision 2 (+1)

Show changes

reviewboard/attachments/forms.py

Tool: PEP8 Style Checker
Processed Files:
    reviewboard/attachments/forms.py



Tool: Pyflakes
Processed Files:
    reviewboard/attachments/forms.py

reviewboard/attachments/forms.py (Diff revision 2)

The issue has been resolved. Show all issues

Can we add a comment above this conditional talking about this, and referencing the bug? It's obscure enough that I think it's worth calling out.

(I'm still a bit skeptical that browsers would be sending such a broken mimetype, but it doesn't hurt to have this I suppose.)

Commit:

9babf6f8c1312aac937622c62d0b88f974519969

d1d8ec2c44f801c05f6aef13c683e0dd54017df8

Diff:

Revision 3 (+12 -6)

Show changes

reviewboard/attachments/forms.py

Tool: PEP8 Style Checker
Processed Files:
    reviewboard/attachments/forms.py



Tool: Pyflakes
Processed Files:
    reviewboard/attachments/forms.py

Ship it!

```
Ship It!
```

Status:: Completed
Change Summary:: Pushed to release-2.0.x (928eb49)