<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>209300</bug_id>
          
          <creation_ts>2020-03-19 12:55:22 -0700</creation_ts>
          <short_desc>Sanitize suggested download filename received from web process</short_desc>
          <delta_ts>2020-03-19 16:32:51 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alex Christensen">achristensen</reporter>
          <assigned_to name="Alex Christensen">achristensen</assigned_to>
          <cc>cdumez</cc>
    
    <cc>thorton</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1631783</commentid>
    <comment_count>0</comment_count>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2020-03-19 12:55:22 -0700</bug_when>
    <thetext>Sanitize suggested download filename received from web process</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1631784</commentid>
    <comment_count>1</comment_count>
      <attachid>394008</attachid>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2020-03-19 12:56:02 -0700</bug_when>
    <thetext>Created attachment 394008
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1631785</commentid>
    <comment_count>2</comment_count>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2020-03-19 12:56:06 -0700</bug_when>
    <thetext>&lt;rdar://problem/59487723&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1631851</commentid>
    <comment_count>3</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2020-03-19 15:00:11 -0700</bug_when>
    <thetext>Found 1 new test failure: fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-backslash.html</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1631878</commentid>
    <comment_count>4</comment_count>
      <attachid>394036</attachid>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2020-03-19 15:31:08 -0700</bug_when>
    <thetext>Created attachment 394036
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1631904</commentid>
    <comment_count>5</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2020-03-19 16:32:50 -0700</bug_when>
    <thetext>Committed r258741: &lt;https://trac.webkit.org/changeset/258741&gt;

All reviewed patches have been landed. Closing bug and clearing flags on attachment 394036.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>394008</attachid>
            <date>2020-03-19 12:56:02 -0700</date>
            <delta_ts>2020-03-19 15:31:04 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-209300-20200319125602.patch</filename>
            <type>text/plain</type>
            <size>2048</size>
            <attacher name="Alex Christensen">achristensen</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL
aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNTg3MjIpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv
Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDIwLTAzLTE5ICBBbGV4IENocmlz
dGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgU2FuaXRpemUgc3Vn
Z2VzdGVkIGRvd25sb2FkIGZpbGVuYW1lIHJlY2VpdmVkIGZyb20gd2ViIHByb2Nlc3MKKyAgICAg
ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwOTMwMAorICAgICAg
ICA8cmRhcjovL3Byb2JsZW0vNTk0ODc3MjM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ
IChPT1BTISkuCisKKyAgICAgICAgKiBVSVByb2Nlc3MvRG93bmxvYWRzL0Rvd25sb2FkUHJveHku
Y3BwOgorICAgICAgICAoV2ViS2l0OjpEb3dubG9hZFByb3h5OjpkZWNpZGVEZXN0aW5hdGlvbldp
dGhTdWdnZXN0ZWRGaWxlbmFtZUFzeW5jKToKKwogMjAyMC0wMy0xOSAgVGltIEhvcnRvbiAgPHRp
bW90aHlfaG9ydG9uQGFwcGxlLmNvbT4KIAogICAgICAgICBJbXBsZW1lbnQgc3VwcG9ydCBmb3Ig
Y3Vyc29yIGludGVyYWN0aW9ucyBvbiBpUGFkCkluZGV4OiBTb3VyY2UvV2ViS2l0L1VJUHJvY2Vz
cy9Eb3dubG9hZHMvRG93bmxvYWRQcm94eS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktp
dC9VSVByb2Nlc3MvRG93bmxvYWRzL0Rvd25sb2FkUHJveHkuY3BwCShyZXZpc2lvbiAyNTg2NDUp
CisrKyBTb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9Eb3dubG9hZHMvRG93bmxvYWRQcm94eS5jcHAJ
KHdvcmtpbmcgY29weSkKQEAgLTQwLDYgKzQwLDcgQEAKICNpbmNsdWRlICJXZWJQcm9jZXNzUG9v
bC5oIgogI2luY2x1ZGUgIldlYlByb3RlY3Rpb25TcGFjZS5oIgogI2luY2x1ZGUgPFdlYkNvcmUv
TUlNRVR5cGVSZWdpc3RyeS5oPgorI2luY2x1ZGUgPFdlYkNvcmUvUmVzb3VyY2VSZXNwb25zZUJh
c2UuaD4KICNpbmNsdWRlIDx3dGYvRmlsZVN5c3RlbS5oPgogI2luY2x1ZGUgPHd0Zi90ZXh0L0NT
dHJpbmcuaD4KICNpbmNsdWRlIDx3dGYvdGV4dC9XVEZTdHJpbmcuaD4KQEAgLTE3OCw3ICsxNzks
NyBAQCB2b2lkIERvd25sb2FkUHJveHk6OmRlY2lkZURlc3RpbmF0aW9uV2l0CiAgICAgaWYgKCFt
X3Byb2Nlc3NQb29sKQogICAgICAgICByZXR1cm47CiAgICAgCi0gICAgbV9wcm9jZXNzUG9vbC0+
ZG93bmxvYWRDbGllbnQoKS5kZWNpZGVEZXN0aW5hdGlvbldpdGhTdWdnZXN0ZWRGaWxlbmFtZSgq
dGhpcywgc3VnZ2VzdGVkRmlsZW5hbWUsIFt0aGlzLCBwcm90ZWN0ZWRUaGlzID0gbWFrZVJlZigq
dGhpcyksIGRvd25sb2FkSUQgPSBkb3dubG9hZElEXSAoQWxsb3dPdmVyd3JpdGUgYWxsb3dPdmVy
d3JpdGUsIFN0cmluZyBkZXN0aW5hdGlvbikgeworICAgIG1fcHJvY2Vzc1Bvb2wtPmRvd25sb2Fk
Q2xpZW50KCkuZGVjaWRlRGVzdGluYXRpb25XaXRoU3VnZ2VzdGVkRmlsZW5hbWUoKnRoaXMsIFJl
c291cmNlUmVzcG9uc2VCYXNlOjpzYW5pdGl6ZVN1Z2dlc3RlZEZpbGVuYW1lKHN1Z2dlc3RlZEZp
bGVuYW1lKSwgW3RoaXMsIHByb3RlY3RlZFRoaXMgPSBtYWtlUmVmKCp0aGlzKSwgZG93bmxvYWRJ
RCA9IGRvd25sb2FkSURdIChBbGxvd092ZXJ3cml0ZSBhbGxvd092ZXJ3cml0ZSwgU3RyaW5nIGRl
c3RpbmF0aW9uKSB7CiAgICAgICAgIFNhbmRib3hFeHRlbnNpb246OkhhbmRsZSBzYW5kYm94RXh0
ZW5zaW9uSGFuZGxlOwogICAgICAgICBpZiAoIWRlc3RpbmF0aW9uLmlzTnVsbCgpKQogICAgICAg
ICAgICAgU2FuZGJveEV4dGVuc2lvbjo6Y3JlYXRlSGFuZGxlKGRlc3RpbmF0aW9uLCBTYW5kYm94
RXh0ZW5zaW9uOjpUeXBlOjpSZWFkV3JpdGUsIHNhbmRib3hFeHRlbnNpb25IYW5kbGUpOwo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>394036</attachid>
            <date>2020-03-19 15:31:08 -0700</date>
            <delta_ts>2020-03-19 16:32:51 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-209300-20200319153106.patch</filename>
            <type>text/plain</type>
            <size>4284</size>
            <attacher name="Alex Christensen">achristensen</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL
aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNTg3MzIpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv
Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDIwLTAzLTE5ICBBbGV4IENocmlz
dGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgU2FuaXRpemUgc3Vn
Z2VzdGVkIGRvd25sb2FkIGZpbGVuYW1lIHJlY2VpdmVkIGZyb20gd2ViIHByb2Nlc3MKKyAgICAg
ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwOTMwMAorICAgICAg
ICA8cmRhcjovL3Byb2JsZW0vNTk0ODc3MjM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgQ2hyaXMg
RHVtZXouCisKKyAgICAgICAgKiBVSVByb2Nlc3MvRG93bmxvYWRzL0Rvd25sb2FkUHJveHkuY3Bw
OgorICAgICAgICAoV2ViS2l0OjpEb3dubG9hZFByb3h5OjpkZWNpZGVEZXN0aW5hdGlvbldpdGhT
dWdnZXN0ZWRGaWxlbmFtZUFzeW5jKToKKwogMjAyMC0wMy0xOSAgVGFrYXNoaSBLb21vcmkgIDxU
YWthc2hpLktvbW9yaUBzb255LmNvbT4KIAogICAgICAgICBbQ3VybF0gQWRkIGFuIEFQSSByZXR1
cm5zIGRlc2NyaXB0aW9uIG9mIHZlcmlmaWNhdGlvbiBlcnJvcnMuCkluZGV4OiBTb3VyY2UvV2Vi
S2l0L1VJUHJvY2Vzcy9Eb3dubG9hZHMvRG93bmxvYWRQcm94eS5jcHAKPT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g
U291cmNlL1dlYktpdC9VSVByb2Nlc3MvRG93bmxvYWRzL0Rvd25sb2FkUHJveHkuY3BwCShyZXZp
c2lvbiAyNTg2NDUpCisrKyBTb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9Eb3dubG9hZHMvRG93bmxv
YWRQcm94eS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTQwLDYgKzQwLDcgQEAKICNpbmNsdWRlICJX
ZWJQcm9jZXNzUG9vbC5oIgogI2luY2x1ZGUgIldlYlByb3RlY3Rpb25TcGFjZS5oIgogI2luY2x1
ZGUgPFdlYkNvcmUvTUlNRVR5cGVSZWdpc3RyeS5oPgorI2luY2x1ZGUgPFdlYkNvcmUvUmVzb3Vy
Y2VSZXNwb25zZUJhc2UuaD4KICNpbmNsdWRlIDx3dGYvRmlsZVN5c3RlbS5oPgogI2luY2x1ZGUg
PHd0Zi90ZXh0L0NTdHJpbmcuaD4KICNpbmNsdWRlIDx3dGYvdGV4dC9XVEZTdHJpbmcuaD4KQEAg
LTE3OCw3ICsxNzksNyBAQCB2b2lkIERvd25sb2FkUHJveHk6OmRlY2lkZURlc3RpbmF0aW9uV2l0
CiAgICAgaWYgKCFtX3Byb2Nlc3NQb29sKQogICAgICAgICByZXR1cm47CiAgICAgCi0gICAgbV9w
cm9jZXNzUG9vbC0+ZG93bmxvYWRDbGllbnQoKS5kZWNpZGVEZXN0aW5hdGlvbldpdGhTdWdnZXN0
ZWRGaWxlbmFtZSgqdGhpcywgc3VnZ2VzdGVkRmlsZW5hbWUsIFt0aGlzLCBwcm90ZWN0ZWRUaGlz
ID0gbWFrZVJlZigqdGhpcyksIGRvd25sb2FkSUQgPSBkb3dubG9hZElEXSAoQWxsb3dPdmVyd3Jp
dGUgYWxsb3dPdmVyd3JpdGUsIFN0cmluZyBkZXN0aW5hdGlvbikgeworICAgIG1fcHJvY2Vzc1Bv
b2wtPmRvd25sb2FkQ2xpZW50KCkuZGVjaWRlRGVzdGluYXRpb25XaXRoU3VnZ2VzdGVkRmlsZW5h
bWUoKnRoaXMsIFJlc291cmNlUmVzcG9uc2VCYXNlOjpzYW5pdGl6ZVN1Z2dlc3RlZEZpbGVuYW1l
KHN1Z2dlc3RlZEZpbGVuYW1lKSwgW3RoaXMsIHByb3RlY3RlZFRoaXMgPSBtYWtlUmVmKCp0aGlz
KSwgZG93bmxvYWRJRCA9IGRvd25sb2FkSURdIChBbGxvd092ZXJ3cml0ZSBhbGxvd092ZXJ3cml0
ZSwgU3RyaW5nIGRlc3RpbmF0aW9uKSB7CiAgICAgICAgIFNhbmRib3hFeHRlbnNpb246OkhhbmRs
ZSBzYW5kYm94RXh0ZW5zaW9uSGFuZGxlOwogICAgICAgICBpZiAoIWRlc3RpbmF0aW9uLmlzTnVs
bCgpKQogICAgICAgICAgICAgU2FuZGJveEV4dGVuc2lvbjo6Y3JlYXRlSGFuZGxlKGRlc3RpbmF0
aW9uLCBTYW5kYm94RXh0ZW5zaW9uOjpUeXBlOjpSZWFkV3JpdGUsIHNhbmRib3hFeHRlbnNpb25I
YW5kbGUpOwpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91
dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMjU4NzMzKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdl
TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMjAtMDMtMTkgIEFsZXggQ2hy
aXN0ZW5zZW4gIDxhY2hyaXN0ZW5zZW5Ad2Via2l0Lm9yZz4KKworICAgICAgICBTYW5pdGl6ZSBz
dWdnZXN0ZWQgZG93bmxvYWQgZmlsZW5hbWUgcmVjZWl2ZWQgZnJvbSB3ZWIgcHJvY2VzcworICAg
ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA5MzAwCisgICAg
ICAgIDxyZGFyOi8vcHJvYmxlbS81OTQ4NzcyMz4KKworICAgICAgICBSZXZpZXdlZCBieSBDaHJp
cyBEdW1lei4KKworICAgICAgICAqIGZhc3QvZG9tL0hUTUxBbmNob3JFbGVtZW50L2FuY2hvci1m
aWxlLWJsb2ItZG93bmxvYWQtaW5jbHVkZXMtYmFja3NsYXNoLWV4cGVjdGVkLnR4dDoKKyAgICAg
ICAgKiBmYXN0L2RvbS9IVE1MQW5jaG9yRWxlbWVudC9hbmNob3ItZmlsZS1ibG9iLWRvd25sb2Fk
LWluY2x1ZGVzLWJhY2tzbGFzaC5odG1sOgorCiAyMDIwLTAzLTE5ICBQZXIgQXJuZSBWb2xsYW4g
IDxwdm9sbGFuQGFwcGxlLmNvbT4KIAogICAgICAgICBbaU9TXSBEZW55IG1hY2ggbG9va3VwIGFj
Y2VzcyB0byBwb3dlciBzZXJ2aWNlCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2RvbS9IVE1MQW5j
aG9yRWxlbWVudC9hbmNob3ItZmlsZS1ibG9iLWRvd25sb2FkLWluY2x1ZGVzLWJhY2tzbGFzaC1l
eHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9kb20vSFRNTEFuY2hv
ckVsZW1lbnQvYW5jaG9yLWZpbGUtYmxvYi1kb3dubG9hZC1pbmNsdWRlcy1iYWNrc2xhc2gtZXhw
ZWN0ZWQudHh0CShyZXZpc2lvbiAyNTg2NDUpCisrKyBMYXlvdXRUZXN0cy9mYXN0L2RvbS9IVE1M
QW5jaG9yRWxlbWVudC9hbmNob3ItZmlsZS1ibG9iLWRvd25sb2FkLWluY2x1ZGVzLWJhY2tzbGFz
aC1leHBlY3RlZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTEsNiArMSw2IEBACiBEb3dubG9hZCBz
dGFydGVkLgotRG93bmxvYWRpbmcgVVJMIHdpdGggc3VnZ2VzdGVkIGZpbGVuYW1lICIqXC5wbmci
CitEb3dubG9hZGluZyBVUkwgd2l0aCBzdWdnZXN0ZWQgZmlsZW5hbWUgIioucG5nIgogRG93bmxv
YWQgY29tcGxldGVkLgotVGhlIHN1Z2dlc3RlZCBmaWxlbmFtZSBhYm92ZSBzaG91bGQgYmUgIipc
LnBuZyIgYW5kIHRoZSBkb3dubG9hZCBzaG91bGQgc3VjY2VlZC4KK1RoZSBzdWdnZXN0ZWQgZmls
ZW5hbWUgYWJvdmUgc2hvdWxkIGJlICIqLnBuZyIgYW5kIHRoZSBkb3dubG9hZCBzaG91bGQgc3Vj
Y2VlZC4KIAogRmlsZSBiYWNrZWQgYmxvYiBVUkwKSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvZG9t
L0hUTUxBbmNob3JFbGVtZW50L2FuY2hvci1maWxlLWJsb2ItZG93bmxvYWQtaW5jbHVkZXMtYmFj
a3NsYXNoLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9kb20vSFRNTEFuY2hv
ckVsZW1lbnQvYW5jaG9yLWZpbGUtYmxvYi1kb3dubG9hZC1pbmNsdWRlcy1iYWNrc2xhc2guaHRt
bAkocmV2aXNpb24gMjU4NjQ1KQorKysgTGF5b3V0VGVzdHMvZmFzdC9kb20vSFRNTEFuY2hvckVs
ZW1lbnQvYW5jaG9yLWZpbGUtYmxvYi1kb3dubG9hZC1pbmNsdWRlcy1iYWNrc2xhc2guaHRtbAko
d29ya2luZyBjb3B5KQpAQCAtMTIsNyArMTIsNyBAQCBpZiAod2luZG93LnRlc3RSdW5uZXIpIHsK
IDwvc2NyaXB0PgogPC9oZWFkPgogPGJvZHk+Ci08cD5UaGUgc3VnZ2VzdGVkIGZpbGVuYW1lIGFi
b3ZlIHNob3VsZCBiZSAiKlwucG5nIiBhbmQgdGhlIGRvd25sb2FkIHNob3VsZCBzdWNjZWVkLjwv
cD4KKzxwPlRoZSBzdWdnZXN0ZWQgZmlsZW5hbWUgYWJvdmUgc2hvdWxkIGJlICIqLnBuZyIgYW5k
IHRoZSBkb3dubG9hZCBzaG91bGQgc3VjY2VlZC48L3A+CiA8YSBpZD0iYmxvYi11cmwiIGRvd25s
b2FkPSIqXCI+RmlsZSBiYWNrZWQgYmxvYiBVUkw8L2E+CiA8c2NyaXB0PgogZnVuY3Rpb24gY2xp
Y2soZWxtdCkK
</data>

          </attachment>
      

    </bug>

</bugzilla>