Remove unsafe Conent-Disposition inferring

tests/unittests/test_http_download.c

@@ -12,108 +12,61 @@
 
 typedef struct {
     char *url;
-    char *filename;
+    char *basename;
 } url_test_t;
 
-typedef struct {
-    char *header;
-    char *filename;
-} header_test_t;
-
-void http_filename_from_url_td(void **state) {
-    int num_tests = 5;
+void http_basename_from_url_td(void **state) {
+    int num_tests = 11;
     url_test_t tests[] = {
       (url_test_t){
         .url = "https://host.test/image.jpeg",
-        .filename = "image.jpeg",
+        .basename = "image.jpeg",
+      },
+      (url_test_t){
+        .url = "https://host.test/image.jpeg#somefragment",
+        .basename = "image.jpeg",
+      },
+      (url_test_t){
+        .url = "https://host.test/image.jpeg?query=param",
+        .basename = "image.jpeg",
+      },
+      (url_test_t){
+        .url = "https://host.test/image.jpeg?query=param&another=one",
+        .basename = "image.jpeg",
       },
       (url_test_t){
         .url = "https://host.test/images/",
-        .filename = "images",
+        .basename = "images",
+      },
+      (url_test_t){
+        .url = "https://host.test/images/../../file",
+        .basename = "file",
+      },
+      (url_test_t){
+        .url = "https://host.test/images/../../file/..",
+        .basename = "index.html",
+      },
+      (url_test_t){
+        .url = "https://host.test/images/..//",
+        .basename = "index.html",
       },
       (url_test_t){
         .url = "https://host.test/",
-        .filename = "index.html",
+        .basename = "index.html",
       },
       (url_test_t){
         .url = "https://host.test",
-        .filename = "index.html",
+        .basename = "index.html",
       },
       (url_test_t){
         .url = "aesgcm://host.test",
-        .filename = "index.html",
+        .basename = "index.html",
       },
     };
 
-    char *filename;
+    char *basename;
     for(int i = 0; i < num_tests; i++) {
-      filename = http_filename_from_url(tests[i].url);
-      assert_string_equal(filename, tests[i].filename);
-    }
-}
-
-void http_filename_from_header_td(void **state) {
-    int num_tests = 11;
-    header_test_t tests[] = {
-      (header_test_t){
-        .header = "Content-Disposition: filename=image.jpeg",
-        .filename = "image.jpeg",
-      },
-      (header_test_t){
-        .header = "Content-Disposition:filename=image.jpeg",
-        .filename = "image.jpeg",
-      },
-      (header_test_t){
-        .header = "CoNteNt-DiSpoSItioN: filename=image.jpeg",
-        .filename = "image.jpeg",
-      },
-      (header_test_t){
-        .header = "Content-Disposition: attachment; filename=image.jpeg",
-        .filename = "image.jpeg",
-      },
-      (header_test_t){
-        .header = "Content-Disposition: filename=",
-        .filename = NULL,
-      },
-      (header_test_t){
-        .header = "Content-Disposition: filename=;",
-        .filename = NULL,
-      },
-      (header_test_t){
-        .header = "Content-Disposition: inline",
-        .filename = NULL,
-      },
-      (header_test_t){
-        .header = "Content-Disposition:",
-        .filename = NULL,
-      },
-      (header_test_t){
-        .header = "Last-Modified: Wed, 21 Oct 2015 07:28:00 GMT ",
-        .filename = NULL,
-      },
-      (header_test_t){
-        .header = "",
-        .filename = NULL,
-      },
-      (header_test_t){
-        .header = NULL,
-        .filename = NULL,
-      },
-    };
-
-    char *got_filename;
-    char *exp_filename;
-    char *header;
-    for(int i = 0; i < num_tests; i++) {
-        header = tests[i].header;
-        exp_filename = tests[i].filename;
-
-        got_filename = http_filename_from_header(header);
-
-        if (exp_filename == NULL) {
-            assert_null(got_filename);
-        } else {
-            assert_string_equal(got_filename, exp_filename);
-        }
+        basename = http_basename_from_url(tests[i].url);
+        assert_string_equal(basename, tests[i].basename);
     }
 }

tests/unittests/test_http_download.h

@@ -1,2 +1 @@
-void http_filename_from_url_td(void **state);
-void http_filename_from_header_td(void **state);
+void http_basename_from_url_td(void **state);

tests/unittests/unittests.c

@@ -628,8 +628,7 @@ main(int argc, char* argv[])
         unit_test(removes_plugin_features),
         unit_test(does_not_remove_feature_when_more_than_one_reference),
 
-        unit_test(http_filename_from_url_td),
-        unit_test(http_filename_from_header_td),
+        unit_test(http_basename_from_url_td),
     };
 
     return run_tests(all_tests);