From 9fd7128f800badbd184baf943d4f799e601201e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=B0spik?= Date: Sat, 9 May 2026 00:38:57 +0300 Subject: [PATCH] fix: encode filenames in redirects (#737) * fix: encode filenames in redirects Signed-off-by: ispik * refactor: don't add another dependency when the one needed exists Signed-off-by: ispik --------- Signed-off-by: ispik --- Cargo.lock | 1 + crates/services/autumn/Cargo.toml | 2 +- crates/services/autumn/src/api.rs | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 3f452c4d..03b3406f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -7002,6 +7002,7 @@ dependencies = [ "tracing", "tracing-subscriber", "ulid 1.2.1", + "url-escape", "utoipa", "utoipa-scalar", "webp", diff --git a/crates/services/autumn/Cargo.toml b/crates/services/autumn/Cargo.toml index 762c4ee3..1636a8ec 100644 --- a/crates/services/autumn/Cargo.toml +++ b/crates/services/autumn/Cargo.toml @@ -31,7 +31,7 @@ imagesize = { workspace = true } # Utility lazy_static = { workspace = true } moka = { workspace = true, features = ["future"] } - +url-escape = { workspace = true } # Serialisation strum_macros = { workspace = true } serde_json = { workspace = true } diff --git a/crates/services/autumn/src/api.rs b/crates/services/autumn/src/api.rs index 49a61c43..c0e45d72 100644 --- a/crates/services/autumn/src/api.rs +++ b/crates/services/autumn/src/api.rs @@ -24,6 +24,7 @@ use sha2::Digest; use tempfile::NamedTempFile; use tokio::time::Instant; use tower_http::cors::{AllowHeaders, Any, CorsLayer}; +use url_escape::encode_component; use utoipa::ToSchema; use crate::{ @@ -479,8 +480,10 @@ async fn fetch_file( // Ensure filename is correct if file_name != file.filename { if file_name == "original" { + let safe_filename = encode_component(&file.filename); + return Ok( - Redirect::permanent(&format!("/{tag}/{file_id}/{}", file.filename)).into_response(), + Redirect::permanent(&format!("/{tag}/{file_id}/{}", safe_filename)).into_response(), ); }