Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: prevent modification of invalid Content-Disposition header to avoid potential parsing errors. #42026

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

gdavidkov
Copy link

@gdavidkov gdavidkov commented May 3, 2024

Description of Change

Introduce validation for the Content-Disposition header to ensure it's parsed correctly before using the extracted filename. This will improve code robustness and prevent potential issues.

Checklist

  • PR description included and stakeholders cc'd
  • [] npm test passes - unable to run it -
  • tests are changed or added

Release Notes

Notes: Prevent modification of invalid Content-Disposition header to avoid potential parsing errors.

Additional info

I was unable to run the tests:
Triggering runners: main
OUT_DIR is: Release
yarn install v1.15.2
warning package.json: No license field
warning package-lock.json found. Your project contains lock files generated by tools other than Yarn. It is advised not to mix package managers in order to avoid resolution inconsistencies caused by unsynchronized lock files. To clear this warning, remove package-lock.json.
warning [email protected]: No license field
[1/4] Resolving packages...
warning Resolution field "[email protected]" is incompatible with requested version "xml2js@^0.4.17"
warning Resolution field "[email protected]" is incompatible with requested version "minimist@~0.0.1"
[2/4] Fetching packages...
error https://registry.yarnpkg.com/@nut-tree/libnut-win32/-/libnut-win32-2.5.2.tgz: Request failed "404 Not Found"
error https://registry.yarnpkg.com/@nut-tree/libnut/-/libnut-2.5.2.tgz: Request failed "404 Not Found"
error https://registry.yarnpkg.com/@nut-tree/nut-js/-/nut-js-3.1.2.tgz: Request failed "404 Not Found"
error https://registry.yarnpkg.com/@nut-tree/libnut-darwin/-/libnut-darwin-2.5.2.tgz: Request failed "404 Not Found"
error https://registry.yarnpkg.com/@nut-tree/libnut-linux/-/libnut-linux-2.5.2.tgz: Request failed "404 Not Found"
error https://registry.yarnpkg.com/@nut-tree/node-mac-permissions/-/node-mac-permissions-2.2.1.tgz: Request failed "404 Not Found"
info [email protected]: The platform "win32" is incompatible with this module.
info "[email protected]" is an optional dependency and failed compatibility check. Excluding it from installation.
info [email protected]: The platform "win32" is incompatible with this module.
info "[email protected]" is an optional dependency and failed compatibility check. Excluding it from installation.
[3/4] Linking dependencies...
error An unexpected error occurred: "ENOENT: no such file or directory, open 'C:\Users\user\AppData\Local\Yarn\Cache\v4\npm-@nut-tree-libnut-2.5.2-0e410c108bee31c57ca5923e409762ff223d70de\node_modules\@nut-tree\libnut\.yarn-metadata.json'".
info If you think this is a bug, please open a bug report with the information provided in "C:\src\electron\spec\yarn-error.log".
info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.

Copy link

welcome bot commented May 3, 2024

💖 Thanks for opening this pull request! 💖

We use semantic commit messages to streamline the release process. Before your pull request can be merged, you should update your pull request title to start with a semantic prefix.

Examples of commit messages with semantic prefixes:

  • fix: don't overwrite prevent_default if default wasn't prevented
  • feat: add app.isPackaged() method
  • docs: app.isDefaultProtocolClient is now available on Linux

Things that will help get your PR across the finish line:

  • Follow the JavaScript, C++, and Python coding style.
  • Run npm run lint locally to catch formatting errors earlier.
  • Document any user-facing changes you've made following the documentation styleguide.
  • Include tests when adding/changing behavior.
  • Include screenshots and animated GIFs whenever possible.

We get a lot of pull requests on this repo, so please be patient and we will get back to you as soon as we can.

@electron-cation electron-cation bot added the new-pr 🌱 PR opened in the last 24 hours label May 3, 2024
@gdavidkov gdavidkov changed the title Prevent modification of invalid Content-Disposition header to avoid potential parsing errors. fix: prevent modification of invalid Content-Disposition header to avoid potential parsing errors. May 3, 2024
// to happen correctly.
std::string filename = "\"" + header.filename() + "\"";
value = decodedFilename + "; filename=" + filename;
if (!header.filename().empty()) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would it be better to check header.parse_result_flags()?

@electron-cation electron-cation bot removed the new-pr 🌱 PR opened in the last 24 hours label May 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants