HTTP Content Disposition

Hi there,

I'm having an issue with the HTTP Content Dispositon header: the filename field of the HTTP::Info record doesn't get filed.

Event **event http_header(c: connection, is_orig: bool, name: string, value: string)** gets the header, but filename is empty in **event HTTP::log_http(rec: HTTP::Info)**.

I'm testing with:

curl -i 'http://httpbin.org/response-headers?Content-Type=application/octet-stream;%20charset=UTF-8&Content-Disposition=attachment;%20filename%3d%22test.json%22'

What say you?

Thanks,
Albert

I just tested this and you’re right, the filename doesn’t show up in the http.log, that’s definitely a bug. It does at least show up in the files.log correctly.

I’ll file a ticket about that field missing in the http log. It looks like some of our http entity tracking might be a bit off.

  .Seth

I thought it might be a bug too…
I already started browsing the source/debugging, but no success so far…
Any leads? Where should I focus my attention?
I would like to submit a pull request!

Albert

I would focus on the interplay where the c$http$current_entity field is set. I’m not exactly sure which script it will be in, but you should be able to find all of the places where that’s set pretty easily.

Looking forward to a fix! :slight_smile:

  .Seth

Also, here the ticket: https://bro-tracker.atlassian.net/projects/BIT/issues/BIT-1493

  .Seth