atlassian / nucleus

A configurable and versatile update server for all your Electron apps
Other
398 stars 93 forks source link

fix: escape attachment names for draft release downloads #83

Open itsananderson opened 4 years ago

itsananderson commented 4 years ago

When you upload a release with a space in the name, the route that serves draft releases truncates the file name.

image

This happens because the file name isn't being escaped, so the Content-disposition directive ends with the space in the file name, and the rest of the file name is ignored by the browser.

The HTTP spec states that filenames should be quoted strings, so this PR JSON.stringifys the file name, which effectively quotes it.

After applying this fix, "draft" downloads with spaces in their names are able to be downloaded correctly.

image

I didn't see any tests for these endpoints, so I didn't add new ones (which would require some test app fixtures), but let me know if you'd prefer to have a test for this fix and I'll look at adding one