romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-28 05:43:06 +03:00
Code Issues Projects Releases Packages Wiki Activity

tool_cb_hdr: with -J, use the redirect name as a backup

Browse source 
The -J / --remote-header-name logic now records the file name part used
in the redirects so that it can use the last one as a name if no
Content-Disposition header arrives.

Add tests to verify:

1641: -J with a redirect and extract the CD contents in the second
response

1642: -J with a redirect but no Content-Disposition, use the name from
the Location: header

1643: -J with two redirects, using the last file name and also use
queries and fragments to verify them stripped off

Closes #20430
This commit is contained in:
Daniel Stenberg 2026-01-25 16:35:53 +01:00
parent 146de2460a
commit fa6a46473e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
8 changed files with 267 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/TODO.md
View file

@ -819,25 +819,6 @@ already transferred before the retry.
See [curl issue 1084](https://github.com/curl/curl/issues/1084)
## consider filename from the redirected URL with `-O` ?
When a user gives a URL and uses `-O`, and curl follows a redirect to a new
URL, the filename is not extracted and used from the newly redirected-to URL
even if the new URL may have a much more sensible filename.
This is clearly documented and helps for security since there is no surprise
to users which filename that might get overwritten, but maybe a new option
could allow for this or maybe `-J` should imply such a treatment as well as
`-J` already allows for the server to decide what filename to use so it
already provides the "may overwrite any file" risk.
This is extra tricky if the original URL has no filename part at all since
then the current code path does error out with an error message, and we cannot
*know* already at that point if curl is redirected to a URL that has a
filename...
See [curl issue 1241](https://github.com/curl/curl/issues/1241)
## retry on network is unreachable
The `--retry` option retries transfers on *transient failures*. We later added

3
docs/cmdline-opts/remote-header-name.md
View file

@ -34,6 +34,9 @@ this option may provide you with rather unexpected filenames.
This feature uses the name from the `filename` field, it does not yet support
the `filename*` field (filenames with explicit character sets).
Starting in 8.19.0, curl falls back and uses the filename extracted from the
last redirect header if no `Content-Disposition:` header provides a filename.
**WARNING**: Exercise judicious use of this option, especially on Windows. A
rogue server could send you the name of a DLL or other file that could be
loaded automatically by Windows or some third party software.