mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Escape filename in Content-Disposition 

We should escape all occurences of ' and \ in here.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
This commit is contained in:
Lukas Reschke 2021-06-02 18:59:43 +02:00 committed by backportbot[bot]
parent 6a29b60260
commit d838108dea
2 changed files with 27 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/public/AppFramework/Http/DownloadResponse.php
View File

@ -30,20 +30,16 @@ namespace OCP\AppFramework\Http;
* @since 7.0.0 * @since 7.0.0
*/ */
class DownloadResponse extends Response { class DownloadResponse extends Response {
private $filename;
private $contentType;
/** /**
* Creates a response that prompts the user to download the file * Creates a response that prompts the user to download the file
* @param string $filename the name that the downloaded file should have * @param string $filename the name that the downloaded file should have
* @param string $contentType the mimetype that the downloaded file should have * @param string $contentType the mimetype that the downloaded file should have
* @since 7.0.0 * @since 7.0.0
*/ */
public function __construct($filename, $contentType) { public function __construct(string $filename, string $contentType) {
parent::__construct(); parent::__construct();
$this->filename = $filename; $filename = strtr($filename, ['"' => '\\"', '\\' => '\\\\']);
$this->contentType = $contentType;
$this->addHeader('Content-Disposition', 'attachment; filename="' . $filename . '"'); $this->addHeader('Content-Disposition', 'attachment; filename="' . $filename . '"');
$this->addHeader('Content-Type', $contentType); $this->addHeader('Content-Type', $contentType);

36
tests/lib/AppFramework/Http/DownloadResponseTest.php
View File

@ -30,22 +30,36 @@ class ChildDownloadResponse extends DownloadResponse {
class DownloadResponseTest extends \Test\TestCase { class DownloadResponseTest extends \Test\TestCase {
/**
* @var ChildDownloadResponse
*/
protected $response;
protected function setUp(): void { protected function setUp(): void {
parent::setUp(); parent::setUp();
$this->response = new ChildDownloadResponse('file', 'content');
} }
public function testHeaders() { public function testHeaders() {
$headers = $this->response->getHeaders(); $response = new ChildDownloadResponse('file', 'content');
$headers = $response->getHeaders();
$this->assertStringContainsString('attachment; filename="file"', $headers['Content-Disposition']); $this->assertEquals('attachment; filename="file"', $headers['Content-Disposition']);
$this->assertStringContainsString('content', $headers['Content-Type']); $this->assertEquals('content', $headers['Content-Type']);
}
/**
* @dataProvider filenameEncodingProvider
*/
public function testFilenameEncoding(string $input, string $expected) {
$response = new ChildDownloadResponse($input, 'content');
$headers = $response->getHeaders();
$this->assertEquals('attachment; filename="'.$expected.'"', $headers['Content-Disposition']);
}
public function filenameEncodingProvider() : array {
return [
['TestName.txt', 'TestName.txt'],
['A "Quoted" Filename.txt', 'A \\"Quoted\\" Filename.txt'],
['A "Quoted" Filename.txt', 'A \\"Quoted\\" Filename.txt'],
['A "Quoted" Filename With A Backslash \\.txt', 'A \\"Quoted\\" Filename With A Backslash \\\\.txt'],
['A "Very" Weird Filename \ / & <> " >\'""""\.text', 'A \\"Very\\" Weird Filename \\\\ / & <> \\" >\'\\"\\"\\"\\"\\\\.text'],
['\\\\\\\\\\\\', '\\\\\\\\\\\\\\\\\\\\\\\\'],
];
} }
} }