agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-05-25 10:10:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #26827 from overleaf/mj-zip-download-name

Browse Source 
[web] Sanitise project name in zip download

GitOrigin-RevId: 3b22da84002f57e3965c529c673344af04db9128
This commit is contained in:
Mathias Jakobsen
2025-07-07 12:12:20 +01:00
committed by Copybot
parent bd3ef799f3
commit 56232b48a7
3 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
services/web/app/src/Features/Compile/CompileController.js
View File

@@ -347,6 +347,7 @@ const _CompileController = {
}
},
// Keep in sync with the logic for zip files in ProjectDownloadsController
_getSafeProjectName(project) {
return project.name.replace(/[^\p{L}\p{Nd}]/gu, '_')
},

7
services/web/app/src/Features/Downloads/ProjectDownloadsController.mjs
View File

@@ -18,6 +18,11 @@ import { prepareZipAttachment } from '../../infrastructure/Response.js'
let ProjectDownloadsController
// Keep in sync with the logic for PDF files in CompileController
function getSafeProjectName(project) {
return project.name.replace(/[^\p{L}\p{Nd}]/gu, '_')
}
export default ProjectDownloadsController = {
downloadProject(req, res, next) {
const projectId = req.params.Project_id
@@ -41,7 +46,7 @@ export default ProjectDownloadsController = {
if (error != null) {
return next(error)
}
prepareZipAttachment(res, `${project.name}.zip`)
prepareZipAttachment(res, `${getSafeProjectName(project)}.zip`)
return stream.pipe(res)
}
)

6
services/web/test/unit/src/Downloads/ProjectDownloadsController.test.mjs
View File

@@ -52,7 +52,7 @@ describe('ProjectDownloadsController', function () {
.stub()
.callsArgWith(1, null, ctx.stream)
ctx.req.params = { Project_id: ctx.project_id }
ctx.project_name = 'project name with accênts'
ctx.project_name = 'project name with accênts and % special characters'
ctx.ProjectGetter.getProject = sinon
.stub()
.callsArgWith(2, null, { name: ctx.project_name })
@@ -95,9 +95,9 @@ describe('ProjectDownloadsController', function () {
.should.equal(true)
})
it('should name the downloaded file after the project', function (ctx) {
it('should name the downloaded file after the project but sanitise special characters', function (ctx) {
ctx.res.headers.should.deep.equal({
'Content-Disposition': `attachment; filename="${ctx.project_name}.zip"`,
'Content-Disposition': `attachment; filename="project_name_with_accênts_and___special_characters.zip"`,
'Content-Type': 'application/zip',
'X-Content-Type-Options': 'nosniff',
})