Ticket #511 (new enhancement)

Opened 9 years ago

Last modified 4 years ago

Directory information in Metalink not used

Reported by: ant Owned by: MaierMan
Priority: trivial Milestone:
Component: Metalink Version: trunk
Keywords: Cc:
Operating System: All

Description

Some .metalinks contain directory information to be created on the local filesystem.

For example,

<file name="abiword/abiword-setup-2.4.6.exe">

should put the downloaded file "abiword-setup-2.4.6.exe" in a subdirectory called "abiword" in the selected download directory.

Sample at  http://www.metalinker.org/test/directory.metalink

Attachments

directory.metalink Download (2.6 KB) - added by ant 9 years ago.

Change History

Changed 9 years ago by ant

Changed 9 years ago by MaierMan

This is intentional for now...

Stuff to get sorted out

  • which formats to accept. /path/file, path/file, path/../path/file, etc, or all. This should be more clear in your spec.
  • security implications (i.e. directory transversal in this case). Spec: is directory transversal allowed, and if no (which I would suggest) what would be the appropriate error-handling/fallback? Show-stopper? Ignore the invalid path?
  • how will it collide with our renaming masks / should the masks be switched off (or parts of the mask for that matter)?
  • how will it collide with the our file collision (file exists) handling?

Please address the spec related issues.

Changed 8 years ago by ant

how about this:

"Directory information can also be contained in the .metalink, in a path/file format only, as in:

<file name="debian-amd64/dists/sarge/Contents-amd64.gz">

In this example, a subdirectory debian-amd64/dists/sarge/ will be created and a file named Contents-amd64.gz will be created inside it. Directory traversal is not allowed. (The formats /path/file and path/../path/file should be rejected)."

if you have additions or want to re-write it so it's clearer to developers, just send it to me. :)

Changed 8 years ago by MaierMan

  • owner set to MaierMan
  • component changed from --- to Metalink

At least we actually use the name attributes of files now instead of rebuilding from URL. See #582.

Changed 6 years ago by jollino

Was this implemented? I just found this after noticing that the metalink files at  http://metated.petarmaric.com/ (the grouped ones) are not downloaded retaining the directory structure described in the metalink file.

Changed 4 years ago by ant

*** Ticket #2181 marked duplicate of this one ***

Note: See TracTickets for help on using tickets.