Merge pull request #15024 from bevanjkay/download-strategy

download_strategy: fix case where filename cannot be parsed
This commit is contained in:
Mike McQuaid 2023-03-21 12:37:35 +00:00 committed by GitHub
commit 8c6f31a7ac
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -491,10 +491,13 @@ class CurlDownloadStrategy < AbstractFileDownloadStrategy
end
end
filename = content_disposition.filename if filename.blank?
next if filename.blank?
# Servers may include '/' in their Content-Disposition filename header. Take only the basename of this, because:
# - Unpacking code assumes this is a single file - not something living in a subdirectory.
# - Directory traversal attacks are possible without limiting this to just the basename.
File.basename(filename || content_disposition.filename)
File.basename(filename)
end
filenames = lines.map(&parse_content_disposition).compact