fix(pdf): sanitise Content-Disposition filename, fix triagedByName test fixture

2026-07-28 17:11:16 +08:00
parent 28929f40e2
commit 740c6da3ba
2 changed files with 3 additions and 2 deletions
@@ -146,7 +146,8 @@ export async function GET(
    closedAt: incident.closedAt instanceof Date ? incident.closedAt.toISOString() : (incident.closedAt as string | null),
  })

-  const filename = `incident-report-${incident.referenceNo ?? id}.pdf`
+  const safeRef = (incident.referenceNo ?? id).replace(/[^A-Za-z0-9\-_.]/g, '_')
+  const filename = `incident-report-${safeRef}.pdf`

  return new NextResponse(Buffer.from(pdfBytes), {
    status: 200,