fix: encode filenames in redirects (#737)

* fix: encode filenames in redirects

Signed-off-by: ispik <ispik@ispik.dev>

* refactor: don't add another dependency when the one needed exists

Signed-off-by: ispik <ispik@ispik.dev>

---------

Signed-off-by: ispik <ispik@ispik.dev>

Cargo.lock

@@ -7002,6 +7002,7 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "ulid 1.2.1",
+ "url-escape",
  "utoipa",
  "utoipa-scalar",
  "webp",

crates/services/autumn/Cargo.toml

@@ -31,7 +31,7 @@ imagesize = { workspace = true }
 # Utility
 lazy_static = { workspace = true }
 moka = { workspace = true, features = ["future"] }
-
+url-escape = { workspace = true }
 # Serialisation
 strum_macros = { workspace = true }
 serde_json = { workspace = true }

crates/services/autumn/src/api.rs

@@ -24,6 +24,7 @@ use sha2::Digest;
 use tempfile::NamedTempFile;
 use tokio::time::Instant;
 use tower_http::cors::{AllowHeaders, Any, CorsLayer};
+use url_escape::encode_component;
 use utoipa::ToSchema;
 
 use crate::{
@@ -479,8 +480,10 @@ async fn fetch_file(
     // Ensure filename is correct
     if file_name != file.filename {
         if file_name == "original" {
+            let safe_filename = encode_component(&file.filename);
+
             return Ok(
-                Redirect::permanent(&format!("/{tag}/{file_id}/{}", file.filename)).into_response(),
+                Redirect::permanent(&format!("/{tag}/{file_id}/{}", safe_filename)).into_response(),
             );
         }