handle different content-disposition and potential path traversal

packages/backend-core/src/objectStore/utils.ts

@@ -37,7 +37,7 @@ export const bucketTTLConfig = (
   days: number
 ): PutBucketLifecycleConfigurationRequest => {
   const lifecycleRule = {
-    ID: "ExpireAfterOneDay",
+    ID: `${bucketName}-ExpireAfterOneDay`,
     Prefix: "",
     Status: "Enabled",
     Expiration: {

packages/server/package.json

@@ -67,6 +67,7 @@
     "bcryptjs": "2.4.3",
     "bull": "4.10.1",
     "chokidar": "3.5.3",
+    "content-disposition": "^0.5.4",
     "cookies": "0.8.0",
     "csvtojson": "2.0.10",
     "curlconverter": "3.21.0",

packages/server/src/integrations/rest.ts

@@ -22,6 +22,8 @@ import FormData from "form-data"
 import { URLSearchParams } from "url"
 import { blacklist } from "@budibase/backend-core"
 import { handleFileResponse, handleXml } from "./utils"
+import { parse } from "content-disposition"
+import path from "path"
 
 const BodyTypes = {
   NONE: "none",
@@ -134,9 +136,8 @@ class RestIntegration implements IntegrationBase {
 
     const contentType = response.headers.get("content-type") || ""
     const contentDisposition = response.headers.get("content-disposition") || ""
-    const matches =
-      /filename[^;=\n]*=((['"]).*?\2|[^;\n]*)/.exec(contentDisposition) || []
-    filename = matches[1]?.replace(/['"]/g, "") || ""
+    filename =
+      path.basename(parse(contentDisposition).parameters?.filename) || ""
 
     try {
       if (filename) {

yarn.lock

@@ -8570,7 +8570,7 @@ consolidate@^0.16.0:
   dependencies:
     bluebird "^3.7.2"
 
-content-disposition@^0.5.2, content-disposition@^0.5.3, content-disposition@~0.5.2:
+content-disposition@^0.5.2, content-disposition@^0.5.3, content-disposition@^0.5.4, content-disposition@~0.5.2:
   version "0.5.4"
   resolved "https://registry.yarnpkg.com/content-disposition/-/content-disposition-0.5.4.tgz#8b82b4efac82512a02bb0b1dcec9d2c5e8eb5bfe"
   integrity sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==