Skip to content

Commit

Permalink
Don't blow up when passing frozen string to send_file disposition.
Browse files Browse the repository at this point in the history
Since `attachment` does an in-place mutation of `response['Content-Disposition']`, we need to guarantee that this object is not frozen. If a frozen string is passed in, `to_s` is a no-op and returned the same frozen string. So we need to make a new unfrozen string to allow this to work.

Also this could have had interesting side effects if the user had passed in a string while holding a reference to it, they would have found their string to be changed by the call to send_file

```
x = 'inline'
send_file(some_path, disposition: x)
x == 'inline' #=> false
```
  • Loading branch information
Andrew Selder committed Jul 19, 2016
1 parent a5da6fa commit 746e245
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 1 deletion.
2 changes: 1 addition & 1 deletion lib/sinatra/base.rb
Expand Up @@ -358,7 +358,7 @@ def content_type(type = nil, params = {})
# Set the Content-Disposition to "attachment" with the specified filename,
# instructing the user agents to prompt to save.
def attachment(filename = nil, disposition = :attachment)
response['Content-Disposition'] = disposition.to_s
response['Content-Disposition'] = String.new(disposition.to_s)
if filename
params = '; filename="%s"' % File.basename(filename)
response['Content-Disposition'] << params
Expand Down
6 changes: 6 additions & 0 deletions test/helpers_test.rb
Expand Up @@ -879,6 +879,12 @@ def send_file_app(opts={})
assert_equal 'inline; filename="file.txt"', response['Content-Disposition']
end

it "does not raise an error when :disposition set to a frozen string" do
send_file_app :disposition => 'inline'.freeze
get '/file.txt'
assert_equal 'inline; filename="file.txt"', response['Content-Disposition']
end

it "sets the Content-Disposition header when :filename provided" do
send_file_app :filename => 'foo.txt'
get '/file.txt'
Expand Down

0 comments on commit 746e245

Please sign in to comment.