diff options
| author | Carlton Gibson <carlton.gibson@noumenal.es> | 2022-07-20 12:14:45 +0200 |
|---|---|---|
| committer | Carlton Gibson <carlton.gibson@noumenal.es> | 2022-08-03 08:47:19 +0200 |
| commit | 46916665f9aa729067ef894e994854ecf9223157 (patch) | |
| tree | d5212a74e71dd85a40077ee9a2666f08badceaaa /django/http | |
| parent | 5359607c89ddd6022f5c9da5e1e3c04cdab9e07d (diff) | |
[4.1.x] Fixed CVE-2022-36359 -- Escaped filename in Content-Disposition header.
Thanks to Motoyasu Saburi for the report.
Diffstat (limited to 'django/http')
| -rw-r--r-- | django/http/response.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/django/http/response.py b/django/http/response.py index 62b8b1c087..046ed53315 100644 --- a/django/http/response.py +++ b/django/http/response.py @@ -556,7 +556,9 @@ class FileResponse(StreamingHttpResponse): disposition = "attachment" if self.as_attachment else "inline" try: filename.encode("ascii") - file_expr = 'filename="{}"'.format(filename) + file_expr = 'filename="{}"'.format( + filename.replace("\\", "\\\\").replace('"', r"\"") + ) except UnicodeEncodeError: file_expr = "filename*=utf-8''{}".format(quote(filename)) self.headers["Content-Disposition"] = "{}; {}".format( |