Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: c.Attachment and c.Inline should escape filename in Content-Disposition header #2541

Merged
merged 1 commit into from
Nov 7, 2023

Conversation

aldas
Copy link
Contributor

@aldas aldas commented Nov 7, 2023

This fixes #2531

c.Attachment and c.Inline should escape filename in Content-Disposition header to avoid 'Reflect File Download' vulnerability.

This is same as Go std does escaping https://github.com/golang/go/blob/9d836d41d0d9df3acabf7f9607d3b09188a9bfc6/src/mime/multipart/writer.go#L132

Copy link

codecov bot commented Nov 7, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (50ebcd8) 92.89% compared to head (1e63f47) 92.89%.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #2541   +/-   ##
=======================================
  Coverage   92.89%   92.89%           
=======================================
  Files          39       39           
  Lines        4658     4658           
=======================================
  Hits         4327     4327           
  Misses        240      240           
  Partials       91       91           
Files Coverage Δ
context.go 88.88% <100.00%> (ø)

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@aldas aldas merged commit 14daeb9 into labstack:master Nov 7, 2023
16 checks passed
@aldas aldas deleted the quote_filename branch November 7, 2023 12:10
@aldas aldas mentioned this pull request Nov 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Unsafe attachments can corrupt user's local files
1 participant