Skip to content

Conversation

@aldas
Copy link
Contributor

@aldas aldas commented Nov 7, 2023

This fixes #2531

c.Attachment and c.Inline should escape filename in Content-Disposition header to avoid 'Reflect File Download' vulnerability.

This is same as Go std does escaping https://github.com/golang/go/blob/9d836d41d0d9df3acabf7f9607d3b09188a9bfc6/src/mime/multipart/writer.go#L132

@codecov
Copy link

codecov bot commented Nov 7, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (50ebcd8) 92.89% compared to head (1e63f47) 92.89%.

Additional details and impacted files
@@ Coverage Diff @@ ## master #2541 +/- ## ======================================= Coverage 92.89% 92.89% ======================================= Files 39 39 Lines 4658 4658 ======================================= Hits 4327 4327 Misses 240 240 Partials 91 91 
Files Coverage Δ
context.go 88.88% <100.00%> (ø)

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@aldas aldas merged commit 14daeb9 into labstack:master Nov 7, 2023
@aldas aldas deleted the quote_filename branch November 7, 2023 12:10
@aldas aldas mentioned this pull request Nov 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant