download_strategy: fix case where filename cannot be parsed
This commit is contained in:
parent
ffa7ee0112
commit
f197f164c8
@ -491,10 +491,13 @@ class CurlDownloadStrategy < AbstractFileDownloadStrategy
|
||||
end
|
||||
end
|
||||
|
||||
filename ||= content_disposition.filename
|
||||
next if filename.nil?
|
||||
|
||||
# Servers may include '/' in their Content-Disposition filename header. Take only the basename of this, because:
|
||||
# - Unpacking code assumes this is a single file - not something living in a subdirectory.
|
||||
# - Directory traversal attacks are possible without limiting this to just the basename.
|
||||
File.basename(filename || content_disposition.filename)
|
||||
File.basename(filename)
|
||||
end
|
||||
|
||||
filenames = lines.map(&parse_content_disposition).compact
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user