Merge pull request #356 from RomanBurunkov/master

Fix issue #342:URI malformed error.
richardgirges · Sep 20, 2023 · 773dfa3 · 773dfa3
2 parents ee8e711 + 2ba446a
commit 773dfa3
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 2 deletions.
diff --git a/lib/utilities.js b/lib/utilities.js
@@ -229,7 +229,26 @@ const saveBufferToFile = (buffer, filePath, callback) => {
  * @returns {String}
  */
 const uriDecodeFileName = (opts, fileName) => {
-  return opts.uriDecodeFileNames ? decodeURIComponent(fileName) : fileName;
+  const options = opts || {};
+  if (!options.uriDecodeFileNames) {
+    return fileName;
+  }
+  // Decode file name from URI with checking URI malformed errors.
+  // See Issue https://github.com/richardgirges/express-fileupload/issues/342.
+  try {
+    return decodeURIComponent(fileName);
+  } catch (err) {
+    const matcher = /(%[a-f0-9]{2})/gi;
+    return fileName.split(matcher)
+      .map((str) => {
+        try {
+          return decodeURIComponent(str);
+        } catch (err) {
+          return '';
+        }
+      })
+      .join('');
+  }
 };
 
 /**

diff --git a/test/utilities.spec.js b/test/utilities.spec.js
@@ -382,7 +382,8 @@ describe('utilities: Test of the utilities functions', function() {
     const testData = [
       { enc: 'test%22filename', dec: 'test"filename' },
       { enc: 'test%60filename', dec: 'test`filename' },
-      { enc: '%3Fx%3Dtest%22filename', dec: '?x=test"filename'}
+      { enc: '%3Fx%3Dtest%22filename', dec: '?x=test"filename'},
+      { enc: 'bug_bounty_upload_%91%91and%92.txt', dec: 'bug_bounty_upload_and.txt'}
     ];
 
     // Test decoding if uriDecodeFileNames: true.