Page MenuHomePhabricator
Create Task
Maniphest T8984

Text files containing string "code" aren't allowed to upload via drag-n-drop
Closed, ResolvedPublic
Actions

Description

Trying to upload via drag-n-drop a text file containing the string "code" brings up the following error:

Upload Failure
test.txt

Exception: Request includes restricted parameter "code", but this controller ("PhabricatorFileDropUploadController") does not whitelist it. Refusing to serve this request because it might be part of a redirection attack.

Uploading via traditional upload form works.

There seems to be an explicit restriction on the string "code" in HTTP requests: https://secure.phabricator.com/diffusion/P/browse/master/src/applications/base/controller/PhabricatorController.php;504579850f0e9b3f9123908706719cbf8ff4c5d4$131

Since drag-n-drop POSTs the file's contents, the restriction is triggered.

Reproduce:

  • create text file with string "code" in it
  • try to upload it

Revisions and Commits

Restricted Differential RevisionRestricted Diffusion Commit

Event Timeline

fanis created this task.Jul 28 2015, 2:18 PM
fanis raised the priority of this task from to Needs Triage.
fanis updated the task description. (Show Details)
fanis added projects: Files, Security.
fanis added a subscriber: fanis.
Herald added a subscriber: andypuettmann. · View Herald TranscriptJul 28 2015, 2:18 PM
epriestley removed a project: Security.Jul 28 2015, 2:35 PM
epriestley added a subscriber: epriestley.

(Removing Security since this isn't a security vulnerability.)

epriestley added a revision: Restricted Differential Revision.Jul 28 2015, 2:45 PM
epriestley closed this task as Resolved by committing Restricted Diffusion Commit.Jul 28 2015, 3:04 PM
epriestley added a commit: Restricted Diffusion Commit.
fanis awarded a token.Jul 28 2015, 4:10 PM
joshuaspence added a subscriber: joshuaspence.Aug 24 2015, 9:14 PM
Phabricator · Built by Phacility