adalal/gotenberg
1
0
Fork 0
mirror of https://github.com/gotenberg/gotenberg.git synced 2026-08-08 00:22:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): sanitize the output filename header

Browse Source
This commit is contained in:
Julien Neuhart
2026-08-07 16:22:42 +02:00
parent 8d29638b74
commit b71df026f6
4 changed files with 98 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
test/integration/features/chromium_convert_html.feature
View File

@@ -813,8 +813,40 @@ Feature: /forms/chromium/convert/html
"""
# See https://github.com/gotenberg/gotenberg/issues/1130.
# A backslash is not a path separator on Linux, so filepath.Base leaves it in
# place and it reaches the archive entry names. See GHSA-hwc4-gmrw-5222.
@split
@output-filename
Scenario: POST /forms/chromium/convert/html (Split Windows Path As Output Filename)
Given I have a default Gotenberg container
When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
| files | testdata/pages-3-html/index.html | file |
| splitMode | intervals | field |
| splitSpan | 2 | field |
| Gotenberg-Output-Filename | ..\\..\\..\\Windows\\System32\\foo | header |
Then the response status code should be 200
Then the response header "Content-Type" should be "application/zip"
Then there should be 2 PDF(s) in the response
Then there should be the following file(s) in the response:
| foo.zip |
| foo_0.pdf |
| foo_1.pdf |
Scenario: POST /forms/chromium/convert/html (Split Rooted Windows Path As Output Filename)
Given I have a default Gotenberg container
When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
| files | testdata/pages-3-html/index.html | file |
| splitMode | intervals | field |
| splitSpan | 2 | field |
| Gotenberg-Output-Filename | C:\\Windows\\Temp\\foo | header |
Then the response status code should be 200
Then the response header "Content-Type" should be "application/zip"
Then there should be 2 PDF(s) in the response
Then there should be the following file(s) in the response:
| foo.zip |
| foo_0.pdf |
| foo_1.pdf |
Scenario: POST /forms/chromium/convert/html (Split Output Filename)
Given I have a default Gotenberg container
When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):

11
test/integration/features/output_filename.feature
View File

@@ -22,6 +22,17 @@ Feature: Output Filename
Then there should be the following file(s) in the response:
| foo.zip |
# See GHSA-hwc4-gmrw-5222.
Scenario: Windows Path As Filename
Given I have a default Gotenberg container
When I make a "POST" request to Gotenberg at the "/forms/pdfengines/flatten" endpoint with the following form data and header(s):
| files | testdata/page_1.pdf | file |
| Gotenberg-Output-Filename | C:\\Windows\\Temp\\foo | header |
Then the response status code should be 200
Then the response header "Content-Type" should be "application/pdf"
Then there should be the following file(s) in the response:
| foo.pdf |
# See https://github.com/gotenberg/gotenberg/issues/1227.
Scenario: Path As Filename
Given I have a default Gotenberg container