Escape filename in Content-Disposition
We should escape all occurences of ' and \ in here. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
This commit is contained in:
parent
1b4f2d0de1
commit
800edafce8
|
@ -30,20 +30,16 @@ namespace OCP\AppFramework\Http;
|
||||||
* @since 7.0.0
|
* @since 7.0.0
|
||||||
*/
|
*/
|
||||||
class DownloadResponse extends Response {
|
class DownloadResponse extends Response {
|
||||||
private $filename;
|
|
||||||
private $contentType;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Creates a response that prompts the user to download the file
|
* Creates a response that prompts the user to download the file
|
||||||
* @param string $filename the name that the downloaded file should have
|
* @param string $filename the name that the downloaded file should have
|
||||||
* @param string $contentType the mimetype that the downloaded file should have
|
* @param string $contentType the mimetype that the downloaded file should have
|
||||||
* @since 7.0.0
|
* @since 7.0.0
|
||||||
*/
|
*/
|
||||||
public function __construct($filename, $contentType) {
|
public function __construct(string $filename, string $contentType) {
|
||||||
parent::__construct();
|
parent::__construct();
|
||||||
|
|
||||||
$this->filename = $filename;
|
$filename = strtr($filename, ['"' => '\\"', '\\' => '\\\\']);
|
||||||
$this->contentType = $contentType;
|
|
||||||
|
|
||||||
$this->addHeader('Content-Disposition', 'attachment; filename="' . $filename . '"');
|
$this->addHeader('Content-Disposition', 'attachment; filename="' . $filename . '"');
|
||||||
$this->addHeader('Content-Type', $contentType);
|
$this->addHeader('Content-Type', $contentType);
|
||||||
|
|
|
@ -30,22 +30,36 @@ class ChildDownloadResponse extends DownloadResponse {
|
||||||
|
|
||||||
|
|
||||||
class DownloadResponseTest extends \Test\TestCase {
|
class DownloadResponseTest extends \Test\TestCase {
|
||||||
|
|
||||||
/**
|
|
||||||
* @var ChildDownloadResponse
|
|
||||||
*/
|
|
||||||
protected $response;
|
|
||||||
|
|
||||||
protected function setUp(): void {
|
protected function setUp(): void {
|
||||||
parent::setUp();
|
parent::setUp();
|
||||||
$this->response = new ChildDownloadResponse('file', 'content');
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
public function testHeaders() {
|
public function testHeaders() {
|
||||||
$headers = $this->response->getHeaders();
|
$response = new ChildDownloadResponse('file', 'content');
|
||||||
|
$headers = $response->getHeaders();
|
||||||
|
|
||||||
$this->assertStringContainsString('attachment; filename="file"', $headers['Content-Disposition']);
|
$this->assertEquals('attachment; filename="file"', $headers['Content-Disposition']);
|
||||||
$this->assertStringContainsString('content', $headers['Content-Type']);
|
$this->assertEquals('content', $headers['Content-Type']);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @dataProvider filenameEncodingProvider
|
||||||
|
*/
|
||||||
|
public function testFilenameEncoding(string $input, string $expected) {
|
||||||
|
$response = new ChildDownloadResponse($input, 'content');
|
||||||
|
$headers = $response->getHeaders();
|
||||||
|
|
||||||
|
$this->assertEquals('attachment; filename="'.$expected.'"', $headers['Content-Disposition']);
|
||||||
|
}
|
||||||
|
|
||||||
|
public function filenameEncodingProvider() : array {
|
||||||
|
return [
|
||||||
|
['TestName.txt', 'TestName.txt'],
|
||||||
|
['A "Quoted" Filename.txt', 'A \\"Quoted\\" Filename.txt'],
|
||||||
|
['A "Quoted" Filename.txt', 'A \\"Quoted\\" Filename.txt'],
|
||||||
|
['A "Quoted" Filename With A Backslash \\.txt', 'A \\"Quoted\\" Filename With A Backslash \\\\.txt'],
|
||||||
|
['A "Very" Weird Filename \ / & <> " >\'""""\.text', 'A \\"Very\\" Weird Filename \\\\ / & <> \\" >\'\\"\\"\\"\\"\\\\.text'],
|
||||||
|
['\\\\\\\\\\\\', '\\\\\\\\\\\\\\\\\\\\\\\\'],
|
||||||
|
];
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue