DataStore Dump Filename

[JVickery-TBS]

feat(views): ds dump filename;

• Filename for ds dump endpoint.

[wardi]

Seems useful, but do we need to worry about special characters, like if I send someone a link to a dump url with filename=../im_in_ur_homedir.lol what will a browser do?

[wardi]

Also users can choose any file name they like when downloading, so what's the the original problem this is trying to solve? Is this because the default is missing a file extension?

[JVickery-TBS]

This was for a Recombinant feature to dump CSVs for some admin purposes and data migrations. it just allowed for Recombinant to dump the file as <org name>.<resource name>

And yeah, probably should strip out special characters

[wardi]

Newline characters are definitely bad in the filename. That would let an attacker insert their own headers in the response from the server.