download_strategy: fix case where filename cannot be parsed
This commit is contained in:
		
							parent
							
								
									ffa7ee0112
								
							
						
					
					
						commit
						f197f164c8
					
				@ -491,10 +491,13 @@ class CurlDownloadStrategy < AbstractFileDownloadStrategy
 | 
			
		||||
        end
 | 
			
		||||
      end
 | 
			
		||||
 | 
			
		||||
      filename ||= content_disposition.filename
 | 
			
		||||
      next if filename.nil?
 | 
			
		||||
 | 
			
		||||
      # Servers may include '/' in their Content-Disposition filename header. Take only the basename of this, because:
 | 
			
		||||
      # - Unpacking code assumes this is a single file - not something living in a subdirectory.
 | 
			
		||||
      # - Directory traversal attacks are possible without limiting this to just the basename.
 | 
			
		||||
      File.basename(filename || content_disposition.filename)
 | 
			
		||||
      File.basename(filename)
 | 
			
		||||
    end
 | 
			
		||||
 | 
			
		||||
    filenames = lines.map(&parse_content_disposition).compact
 | 
			
		||||
 | 
			
		||||
		Loading…
	
	
			
			x
			
			
		
	
		Reference in New Issue
	
	Block a user