[Rp-13-byt]

Summary

Fixes a potential path traversal vulnerability in fetch_http() where an untrusted Content-Disposition header filename could escape the intended download directory.

Root Cause

fetch_http() directly used params.get("filename") from the untrusted response header Content-Disposition to construct the target output_file = Path(download_directory, filename) without validating path containment or stripping traversal sequences.

Changes

• Introduce is_safe_filename() to validate that filenames do not contain POSIX or Windows path separators (/, \), Windows drive prefixes (:), null or control characters (\x00-\x1f, \x7f), or relative directory references (., ..).
• Resolve both candidate output paths and download directories with Path.resolve() and enforce is_relative_to() containment checks, preventing directory escapes and symlink redirection outside the download folder.
• Fall back to the URL-derived filename when Content-Disposition has an empty or whitespace-only filename parameter.
• Raise ValueError if an invalid, unsafe, or traversal-attempt filename is encountered.
• Add regression tests in test_fetch.py for traversal sequences, absolute paths, Windows path syntax, control/null characters, empty names, safe names, and symlink escapes.

[Rp-13-byt]

Hi maintainers,

I’d appreciate a review of this PR when someone has a chance.

The change focuses on validating filenames received through the HTTP Content-Disposition header and ensuring the resolved output path remains within the intended download directory. I’ve also added regression tests covering traversal attempts, absolute paths, Windows-style paths, invalid characters, empty filenames, and symlink escapes.

I’ve kept the changes focused on the HTTP download path to make the fix easier to review. Could you please let me know whether the validation and fallback behavior align with the project’s expectations, or if there are any edge cases you’d recommend addressing?

I’d also like to become more involved in the ScanCode.io contributor community. Could you point me toward the preferred community channel, such as an official Slack workspace, chat group, or contributor discussion forum, where developers can discuss ongoing work and coordinate contributions?

I’m happy to make any adjustments based on your feedback. Thanks for your time and for maintaining ScanCode.io.