To prevent spammers from abusing this feature on a public server, do not include query parameters in the generated filenames. See https://github.com/mozilla-conduit/phabricator/commit/d8bb7d91b7d219902afed1ae7a8ae5e33862a842.
Ref T15665.
Differential D25478
Use predictable filenames when downloading raw diffs from a revision • l2dy on Nov 26 2023, 15:35. Authored by
Details
To prevent spammers from abusing this feature on a public server, do not include query parameters in the generated filenames. See https://github.com/mozilla-conduit/phabricator/commit/d8bb7d91b7d219902afed1ae7a8ae5e33862a842. Ref T15665. Download raw diff from a revision and check filename in URL.
Diff Detail
Event TimelineComment Actions What do you think about keeping the current naming scheme but whitelisting a handful of query params to use instead of using them all? The timestamp adds noise and it's probably nice to see the ID of the diff in the filename, e.g. D25478.id1541.diff? Maybe just allow the the id parameter and regex that it's value is just a string of numbers. Comment Actions That's a good idea. I think we should keep both id and vs. Any other parameters worth keeping? Comment Actions I spent only 5 minutes playing around on a diff to see what might make the url change. The diff id is probably the key one I’d be interested in keeping. I don’t know what the other params are for (even vs). Comment Actions id, vs and /new/ in URL all affect content of the generated file.
Keeping id alone could cause confusion, because the output is also affected by vs. I'm inclined to commit as is if there is a certain degree of urgency for the fix, or otherwise take the time to check all arguments that could affect output. Comment Actions As far as I can understand, the generated file name here is 100% for commodity purposes: not used for anything on the filesystem, not used as unique key in something, not used to check whenever the file should be created again or not. We can also have all files called "ASDLOL" and would be OK for the system.
Comment Actions Ah, before landing, please consider an additional line in the comment (like the proposed one) Comment Actions Maybe better to land this to help the author. The author cannot receive email notifications. |