admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

Merge pull request #10862 from Bo98/ds_cd_fix

Browse Source 
download_strategy: take basename of response-content-disposition query
This commit is contained in:
Bo Anderson 2021-03-16 15:47:38 +00:00 committed by GitHub
commit 7df5f22e50
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Library/Homebrew/download_strategy.rb
View File

@ -313,7 +313,7 @@ class AbstractFileDownloadStrategy < AbstractDownloadStrategy
query_params = CGI.parse(uri.query)
query_params["response-content-disposition"].each do |param|
query_basename = param[/attachment;\s*filename=(["']?)(.+)\1/i, 2]
return query_basename if query_basename
return File.basename(query_basename) if query_basename
end
end
@ -463,7 +463,7 @@ class CurlDownloadStrategy < AbstractFileDownloadStrategy
# Servers may include '/' in their Content-Disposition filename header. Take only the basename of this, because:
# - Unpacking code assumes this is a single file - not something living in a subdirectory.
# - Directory traversal attacks are possible without limiting this to just the basename.
(filename || content_disposition.filename).rpartition("/")[-1]
File.basename(filename || content_disposition.filename)
end
filenames = lines.map(&parse_content_disposition).compact