fix: serve JSON and text downloads inline so they open in the browser - #2217
Open
MGpromax wants to merge 1 commit into
Open
fix: serve JSON and text downloads inline so they open in the browser#2217MGpromax wants to merge 1 commit into
MGpromax wants to merge 1 commit into
Conversation
download_project_file() forced every input and output file download with as_attachment=True, so JSON results always downloaded as a separate file instead of opening in the browser. Serve .json and .txt files inline with their content type; other formats keep forcing a download. HTML is deliberately not served inline since generated attribution documents may embed third-party package data. Closes aboutcode-org#2210 Signed-off-by: Manoj Gowda <manojgowdabs18@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2210
download_project_file()forcedas_attachment=Truefor every input and output file, so a JSON output always became a separate download. This serves.jsonand.txtfiles inline instead --FileResponsethen also sets the proper content type from the filename (application/json/text/plain), so they open directly in the browser; all other formats keep forcing a download.One deliberate scoping choice:
.html(e.g. generated attribution documents) is not served inline, since those embed data derived from scanned third-party packages and rendering them in the app origin would be an XSS vector. Happy to extend the inline set if you prefer.Tested with the existing download view tests plus a new one asserting
Content-Type: application/jsonandContent-Disposition: inlinefor a JSON output (3/3 pass on sqlite locally).