jmug/stoatchat
1
0
Fork 1
Code Issues Packages Projects Releases Wiki Activity

fix: encode filenames in redirects (#737)

Browse Source 
* fix: encode filenames in redirects

Signed-off-by: ispik <ispik@ispik.dev>

* refactor: don't add another dependency when the one needed exists

Signed-off-by: ispik <ispik@ispik.dev>

---------

Signed-off-by: ispik <ispik@ispik.dev>
This commit is contained in:
İspik
2026-05-09 00:38:57 +03:00
committed by GitHub
parent df276ac40b
commit 9fd7128f80
3 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Cargo.lock generated
View File

@@ -7002,6 +7002,7 @@ dependencies = [
"tracing", "tracing",
"tracing-subscriber", "tracing-subscriber",
"ulid 1.2.1", "ulid 1.2.1",
"url-escape",
"utoipa", "utoipa",
"utoipa-scalar", "utoipa-scalar",
"webp", "webp",

2
crates/services/autumn/Cargo.toml
View File

@@ -31,7 +31,7 @@ imagesize = { workspace = true }
# Utility # Utility
lazy_static = { workspace = true } lazy_static = { workspace = true }
moka = { workspace = true, features = ["future"] } moka = { workspace = true, features = ["future"] }
url-escape = { workspace = true }
# Serialisation # Serialisation
strum_macros = { workspace = true } strum_macros = { workspace = true }
serde_json = { workspace = true } serde_json = { workspace = true }

5
crates/services/autumn/src/api.rs
View File

@@ -24,6 +24,7 @@ use sha2::Digest;
use tempfile::NamedTempFile; use tempfile::NamedTempFile;
use tokio::time::Instant; use tokio::time::Instant;
use tower_http::cors::{AllowHeaders, Any, CorsLayer}; use tower_http::cors::{AllowHeaders, Any, CorsLayer};
use url_escape::encode_component;
use utoipa::ToSchema; use utoipa::ToSchema;
use crate::{ use crate::{
@@ -479,8 +480,10 @@ async fn fetch_file(
// Ensure filename is correct // Ensure filename is correct
if file_name != file.filename { if file_name != file.filename {
if file_name == "original" { if file_name == "original" {
let safe_filename = encode_component(&file.filename);
return Ok( return Ok(
Redirect::permanent(&format!("/{tag}/{file_id}/{}", file.filename)).into_response(), Redirect::permanent(&format!("/{tag}/{file_id}/{}", safe_filename)).into_response(),
); );
} }