vaultwarden
/
vaultwarden-alternativa-bitwarden
mirror of https://github.com/dani-garcia/vaultwarden.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix attachment upload size check (#4282) 

The min/max were reversed with the `add` and `sub` functions.
This caused the files to always be out of bounds in the check.

Fixes #4281
This commit is contained in:
Mathijs van Veluw 2024-01-28 23:32:09 +01:00 committed by GitHub
parent edf7484a70
commit 0f39d96518
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/api/core/ciphers.rs
View File

@ -1123,12 +1123,12 @@ async fn save_attachment(
// the client. Upstream allows +/- 1 MiB deviation from this // the client. Upstream allows +/- 1 MiB deviation from this
// size, but it's not clear when or why this is needed. // size, but it's not clear when or why this is needed.
const LEEWAY: i64 = 1024 * 1024; // 1 MiB const LEEWAY: i64 = 1024 * 1024; // 1 MiB
let Some(min_size) = attachment.file_size.checked_add(LEEWAY) else { let Some(max_size) = attachment.file_size.checked_add(LEEWAY) else {
err!("Invalid attachment size min")
};
let Some(max_size) = attachment.file_size.checked_sub(LEEWAY) else {
err!("Invalid attachment size max") err!("Invalid attachment size max")
}; };
let Some(min_size) = attachment.file_size.checked_sub(LEEWAY) else {
err!("Invalid attachment size min")
};
if min_size <= size && size <= max_size { if min_size <= size && size <= max_size {
if size != attachment.file_size { if size != attachment.file_size {