Changeset 128050 in webkit

Timestamp:

Sep 10, 2012 6:06:30 AM (12 years ago)

Author:

Carlos Garcia Campos

Message:

[GTK] Sanitize the suggested filename when building the download destination URI
​https://bugs.webkit.org/show_bug.cgi?id=96260

Reviewed by Gustavo Noronha Silva.

The suggested filename returned by the server can contain
directory separators so that the filename would be interpreted as
a full path.

• UIProcess/API/gtk/WebKitDownload.cpp:

(webkitDownloadDecideDestination): Convert any directory separator
contained in the suggested filename to an underscore.

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/API/gtk/WebKitDownload.cpp (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2012-09-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Sanitize the suggested filename when building the download destination URI
+        https://bugs.webkit.org/show_bug.cgi?id=96260
+
+        Reviewed by Gustavo Noronha Silva.
+
+        The suggested filename returned by the server can contain
+        directory separators so that the filename would be interpreted as
+        a full path.
+
+        * UIProcess/API/gtk/WebKitDownload.cpp:
+        (webkitDownloadDecideDestination): Convert any directory separator
+        contained in the suggested filename to an underscore.
+
 2012-09-10  Simon Hausmann  <simon.hausmann@nokia.com>
 

trunk/Source/WebKit2/UIProcess/API/gtk/WebKitDownload.cpp

@@ -99 +99 @@
     if (!download->priv->destinationURI.isNull())
         return FALSE;
-    GOwnPtr<char> destination(g_build_filename(g_get_user_special_dir(G_USER_DIRECTORY_DOWNLOAD), suggestedFilename, NULL));
+
+    GOwnPtr<char> filename(g_strdelimit(g_strdup(suggestedFilename), G_DIR_SEPARATOR_S, '_'));
+    GOwnPtr<char> destination(g_build_filename(g_get_user_special_dir(G_USER_DIRECTORY_DOWNLOAD), filename.get(), NULL));
     GOwnPtr<char> destinationURI(g_filename_to_uri(destination.get(), 0, 0));
     download->priv->destinationURI = destinationURI.get();