From 10a3f4fa192deb08994479cea4eff97bfe02f32d Mon Sep 17 00:00:00 2001 From: David Lawrence Date: Tue, 29 Aug 2023 14:25:33 -0400 Subject: [PATCH] Use predictable filenames when downloading raw diffs from a revision Summary: To prevent spammers from abusing this feature on a public server, do not include query parameters in the generated filenames. See . Ref T15665. Test Plan: Download raw diff from a revision and check filename in URL. Reviewers: O1 Blessed Committers, valerio.bozzolan Reviewed By: O1 Blessed Committers, valerio.bozzolan Subscribers: speck, tobiaswiese, valerio.bozzolan, Matthew, Cigaryno Maniphest Tasks: T15665 Differential Revision: https://we.phorge.it/D25478 Signed-off-by: Zero King --- .../DifferentialRevisionViewController.php | 21 +++++++------------ 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/src/applications/differential/controller/DifferentialRevisionViewController.php b/src/applications/differential/controller/DifferentialRevisionViewController.php index 102c7f560b..ff5cd7373f 100644 --- a/src/applications/differential/controller/DifferentialRevisionViewController.php +++ b/src/applications/differential/controller/DifferentialRevisionViewController.php @@ -1090,20 +1090,13 @@ final class DifferentialRevisionViewController $request_uri = $this->getRequest()->getRequestURI(); - // this ends up being something like - // D123.diff - // or the verbose - // D123.vs123.id123.highlightjs.diff - // lame but nice to include these options - $file_name = ltrim($request_uri->getPath(), '/').'.'; - foreach ($request_uri->getQueryParamsAsPairList() as $pair) { - list($key, $value) = $pair; - if ($key == 'download') { - continue; - } - $file_name .= $key.$value.'.'; - } - $file_name .= 'diff'; + // Filename ends up being something like D123.1692295858.diff + // This discards some options in the query string that may affect the diff + // response, but is intentional to avoid spammy titles from bot requests. + $timestamp = + PhabricatorTime::getNow() + + phutil_units('24 hours in seconds'); + $file_name = ltrim($request_uri->getPath(), '/').'.'.$timestamp.'.diff'; $iterator = new ArrayIterator(array($raw_diff)); -- 2.54.0