diff --git a/Library/Homebrew/download_strategy.rb b/Library/Homebrew/download_strategy.rb index 0186a3aca8..0074b62ec7 100644 --- a/Library/Homebrew/download_strategy.rb +++ b/Library/Homebrew/download_strategy.rb @@ -491,10 +491,13 @@ class CurlDownloadStrategy < AbstractFileDownloadStrategy end end + filename = content_disposition.filename if filename.blank? + next if filename.blank? + # Servers may include '/' in their Content-Disposition filename header. Take only the basename of this, because: # - Unpacking code assumes this is a single file - not something living in a subdirectory. # - Directory traversal attacks are possible without limiting this to just the basename. - File.basename(filename || content_disposition.filename) + File.basename(filename) end filenames = lines.map(&parse_content_disposition).compact