1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
Description: Fix lack of escaping of filename in Content-Disposition
Author: <https://github.com/motoyasu-saburi>
Origin: <upstream>, <https://github.com/gin-gonic/gin/pull/3556>
Forwarded: <https://github.com/gin-gonic/gin/pull/3556>
Applied-Upstream: <https://github.com/gin-gonic/gin/commit/2d4bbec941551479b1fdf1e54ece03e6e82a7e72>
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- a/context.go
+++ b/context.go
@@ -1034,11 +1034,17 @@
http.FileServer(fs).ServeHTTP(c.Writer, c.Request)
}
+var quoteEscaper = strings.NewReplacer("\\", "\\\\", `"`, "\\\"")
+
+func escapeQuotes(s string) string {
+ return quoteEscaper.Replace(s)
+}
+
// FileAttachment writes the specified file into the body stream in an efficient way
// On the client side, the file will typically be downloaded with the given filename
func (c *Context) FileAttachment(filepath, filename string) {
if isASCII(filename) {
- c.Writer.Header().Set("Content-Disposition", `attachment; filename="`+filename+`"`)
+ c.Writer.Header().Set("Content-Disposition", `attachment; filename="`+escapeQuotes(filename)+`"`)
} else {
c.Writer.Header().Set("Content-Disposition", `attachment; filename*=UTF-8''`+url.QueryEscape(filename))
}
--- a/context_test.go
+++ b/context_test.go
@@ -1034,6 +1034,20 @@
assert.Equal(t, fmt.Sprintf("attachment; filename=\"%s\"", newFilename), w.Header().Get("Content-Disposition"))
}
+func TestContextRenderAndEscapeAttachment(t *testing.T) {
+ w := httptest.NewRecorder()
+ c, _ := CreateTestContext(w)
+ maliciousFilename := "tampering_field.sh\"; \\\"; dummy=.go"
+ actualEscapedResponseFilename := "tampering_field.sh\\\"; \\\\\\\"; dummy=.go"
+
+ c.Request, _ = http.NewRequest("GET", "/", nil)
+ c.FileAttachment("./gin.go", maliciousFilename)
+
+ assert.Equal(t, 200, w.Code)
+ assert.Contains(t, w.Body.String(), "func New() *Engine {")
+ assert.Equal(t, fmt.Sprintf("attachment; filename=\"%s\"", actualEscapedResponseFilename), w.Header().Get("Content-Disposition"))
+}
+
func TestContextRenderUTF8Attachment(t *testing.T) {
w := httptest.NewRecorder()
c, _ := CreateTestContext(w)
|
