mirrors/brew
1
0
Fork 0
mirror of https://github.com/Homebrew/brew.git synced 2025-07-14 16:09:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

download_strategy: handle incorrectly quoted filename* headers

Browse Source 
Some servers erroneously double-quote the filename in the filename*
header. This is (as far as I can tell from the spec) a bug in the
server, and should be fixed there.

In general though using `""` as the filename seems like behaviour worth
handling in brew anyway, as there may be other places where the parser
returns an empty string.

Co-authored-by: Mike McQuaid <mike@mikemcquaid.com>
This commit is contained in:
Gibson Fahnestock 2023-02-27 22:13:59 +00:00 committed by Gibson Fahnestock
parent 3e2c713c92
commit 160e7da779
No known key found for this signature in database
GPG Key ID: 27B5B73ED57D8D42
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Library/Homebrew/download_strategy.rb
View File

@ -483,7 +483,13 @@ class CurlDownloadStrategy < AbstractFileDownloadStrategy
if (filename_with_encoding = content_disposition.parameters["filename*"]) if (filename_with_encoding = content_disposition.parameters["filename*"])
encoding, encoded_filename = filename_with_encoding.split("''", 2) encoding, encoded_filename = filename_with_encoding.split("''", 2)
filename = URI.decode_www_form_component(encoded_filename).encode(encoding) if encoding && encoded_filename # If the `filename*` has incorrectly added double quotes, e.g.
# content-disposition: attachment; filename="myapp-1.2.3.pkg"; filename*=UTF-8''"myapp-1.2.3.pkg"
# Then the encoded_filename will come back as the empty string, in which case we should fall back to the
# `filename` parameter.
if encoding && encoded_filename.present?
filename = URI.decode_www_form_component(encoded_filename).encode(encoding)
end
end end
# Servers may include '/' in their Content-Disposition filename header. Take only the basename of this, because: # Servers may include '/' in their Content-Disposition filename header. Take only the basename of this, because: