From 9ba481f2c8e7f1db6144ece7119d8cc314c57bc5 Mon Sep 17 00:00:00 2001
From: Kitsune Ral <Kitsune-Ral@users.sf.net>
Date: Sat, 23 Mar 2019 20:43:02 +0900
Subject: Room::downloadFile(): Tighten URL validations

Check the URL before passing over to Connection::downloadFile(), not only the file name.
---
 lib/events/eventcontent.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lib/events/eventcontent.cpp')

diff --git a/lib/events/eventcontent.cpp b/lib/events/eventcontent.cpp
index 9a5e872c..77f756cd 100644
--- a/lib/events/eventcontent.cpp
+++ b/lib/events/eventcontent.cpp
@@ -50,6 +50,12 @@ FileInfo::FileInfo(const QUrl& u, const QJsonObject& infoJson,
         mimeType = QMimeDatabase().mimeTypeForData(QByteArray());
 }
 
+bool FileInfo::isValid() const
+{
+    return url.scheme() == "mxc"
+            && (url.authority() + url.path()).count('/') == 1;
+}
+
 void FileInfo::fillInfoJson(QJsonObject* infoJson) const
 {
     Q_ASSERT(infoJson);
-- 
cgit v1.2.3