For cisagov#524, handle filenames with spaces in extracted_files_http…

…_server.py
mmguero-dev · Jan 9, 2025 · dea3ce7 · dea3ce7
1 parent eae26a7
commit dea3ce7
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 4 deletions.
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
@@ -194,7 +194,9 @@ http {
     # extracted file download
     location ~* ^/extracted-files\b(.*) {
       include /etc/nginx/nginx_auth_rt.conf;
-      proxy_pass http://extracted-file-http-server$1$is_args$args;
+      # thanks to https://stackoverflow.com/a/31440150, handle spaces in names
+      set $filereq $1;
+      proxy_pass http://extracted-file-http-server$filereq$is_args$args;
       proxy_redirect off;
       proxy_set_header Host file-monitor.malcolm.local;
     }
@@ -204,8 +206,9 @@ http {
       include /etc/nginx/nginx_auth_rt.conf;
       include /etc/nginx/nginx_system_resolver.conf;
       set $upstream $1:8006;
+      set $filereq $2;
       # TODO: check, do i need is_args/args here?
-      rewrite ^/hh-extracted-files/([a-zA-Z0-9-\.]+)(.*)$ $2 break;
+      rewrite ^/hh-extracted-files/([a-zA-Z0-9-\.]+)(.*)$ $filereq break;
       proxy_pass https://$upstream;
       proxy_ssl_verify off;
       proxy_set_header Host $1;

diff --git a/nginx/nginx_readonly.conf b/nginx/nginx_readonly.conf
@@ -13,6 +13,9 @@ http {
   sendfile on;
 
   client_max_body_size 20m;
+  client_body_buffer_size 128k;
+  client_header_buffer_size 256k;
+  large_client_header_buffers 8 256k;
 
   fastcgi_buffers 16 64k;
   fastcgi_buffer_size 256k;
@@ -124,7 +127,10 @@ http {
 
     # extracted file download
     location ~* ^/extracted-files\b(.*) {
-      proxy_pass http://extracted-file-http-server$1;
+      include /etc/nginx/nginx_auth_rt.conf;
+      # thanks to https://stackoverflow.com/a/31440150, handle spaces in names
+      set $filereq $1;
+      proxy_pass http://extracted-file-http-server$filereq$is_args$args;
       proxy_redirect off;
       proxy_set_header Host file-monitor.malcolm.local;
     }
@@ -133,7 +139,9 @@ http {
     location ~* ^/hh-extracted-files/([a-zA-Z0-9-\.]+)\b(.*) {
       include /etc/nginx/nginx_system_resolver.conf;
       set $upstream $1:8006;
-      rewrite ^/hh-extracted-files/([a-zA-Z0-9-\.]+)(.*)$ $2 break;
+      set $filereq $2;
+      # TODO: check, do i need is_args/args here?
+      rewrite ^/hh-extracted-files/([a-zA-Z0-9-\.]+)(.*)$ $filereq break;
       proxy_pass https://$upstream;
       proxy_ssl_verify off;
       proxy_set_header Host $1;