Ophir LOJKINE
c37ce26351
The csv and download components built the Content-Disposition header by string-interpolating the user-supplied filename. A filename containing characters such as ';', '"' or '=' could inject an additional header parameter (e.g. a second, agent-preferred filename*=...), letting an app that interpolates untrusted data into the filename smuggle a different download name past the intended one. Build the header with actix-web's structured ContentDisposition type so the filename is always a single, properly quoted/escaped value and cannot create new parameters.
6 lines
107 B
SQL
6 lines
107 B
SQL
select
|
|
'csv' as component,
|
|
'report.csv; filename*=UTF-8''''evil.html' as filename;
|
|
|
|
select 1 as a;
|