Mercurial > hg > orthanc
changeset 6667:eeeca0b5fab6 machine-spirits
sanitize "Content-Disposition" in HttpOutput::AnswerWithoutBuffering()
| author | Sebastien Jodogne <s.jodogne@gmail.com> |
|---|---|
| date | Wed, 25 Mar 2026 08:26:53 +0100 |
| parents | 91d41f1b3b73 |
| children | 5ce108190752 6c68b240caf2 |
| files | NEWS OrthancFramework/Sources/HttpServer/HttpOutput.cpp |
| diffstat | 2 files changed, 2 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/NEWS Mon Mar 23 08:08:49 2026 +0100 +++ b/NEWS Wed Mar 25 08:26:53 2026 +0100 @@ -67,6 +67,7 @@ - Fix possible memory exhaustion via very large "Content-Length" - Fix possible memory exhaustion via forged ZIP metadata - Fix possible memory exhaustion via forged gzip metadata + - Sanitize HTTP header "Content-Disposition" when creating ZIP archives * Upgraded dependencies for static builds: - boost 1.89.0 - dcmtk 3.7.0
--- a/OrthancFramework/Sources/HttpServer/HttpOutput.cpp Mon Mar 23 08:08:49 2026 +0100 +++ b/OrthancFramework/Sources/HttpServer/HttpOutput.cpp Wed Mar 25 08:26:53 2026 +0100 @@ -981,7 +981,7 @@ std::string filename; if (stream.HasContentFilename(filename)) { - stateMachine_.AddHeader("Content-Disposition", "filename=\"" + std::string(filename) + "\""); + stateMachine_.SetContentFilename(filename.c_str()); } stateMachine_.StartStream(contentType);