k/downloadwf
1
Fork 0
Code Releases Activity

fileName now take the upload code

Browse Source
This commit is contained in:
Anaïs Saraiva
2026-08-15 11:45:20 +02:00
parent bdb418f613
commit adf37d43a3
3 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -3
View File
@@ -270,10 +270,12 @@ paths or stack traces.
(salted), never in plaintext. Successful entry mints a short-lived HMAC-signed
cookie, so access is granted by the server and cannot be forged.
- **Path safety.** Filesystem paths are built only from server-generated,
regex-validated ids (`^[a-z0-9]{12}$`). The original filename is metadata
regex-validated ids (`^[a-z0-9]{8}$`). The original filename is metadata
only and is sanitized (basename, control/null bytes stripped) before being
stored or emitted in `Content-Disposition`. Path traversal, `../`, encoded
traversal, null bytes, and symlink injection via user input are not possible.
stored; downloads are sent as `<upload-key>.<extension>`, so the basename in
`Content-Disposition` is always the server-generated key. Path traversal,
`../`, encoded traversal, null bytes, and symlink injection via user input are
not possible.
Downloads additionally refuse symlinks (`lstat`) as defense in depth.
- **MIME / XSS.** Downloads are sent as `Content-Disposition: attachment` (browsers
download rather than render) with `X-Content-Type-Options: nosniff`, so a spoofed