fix(trueforge-ui): encode artifact paths in download links - #686
Open
CaptainAni187 wants to merge 1 commit into
Open
fix(trueforge-ui): encode artifact paths in download links#686CaptainAni187 wants to merge 1 commit into
CaptainAni187 wants to merge 1 commit into
Conversation
Artifact paths come from the model's sandbox_artifacts fence, so a generated file name can contain characters that change what the URL means: a space or % breaks the request, # silently truncates it, and ?/& inject query parameters. The href was built by raw concatenation, so those reached the anchor verbatim. Encode each path segment, which leaves / doing its structural job and escapes everything else. Percent-encoding a path segment is what the server already expects, so existing links are unaffected. Fixes truefoundry#424
CaptainAni187
requested review from
govindavashishtha,
kumarsks619,
qaifi-tf,
sajal-truefoundry,
sayan-truefoundry and
vinit-truefoundry
as code owners
September 10, 2026 19:13
🦋 Changeset detectedLatest commit: 5a9b686 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Artifact paths come from the model's
sandbox_artifactsfence and were concatenated into the downloadhrefunencoded, so a generated name containing a space,#,?,&or%produced a broken or misparsed URL.#in particular silently truncates the rest.Closes #424
Changes
ChatFileDownload, so/keeps its structural meaning and everything else is escaped#,&,?,%and non-ASCII namesWorth flagging: not
encodeURIComponent(path)as the issue suggests.fileDownloadBaseUrlis a path prefix, not a?path=query, so encoding the whole string turns/report.pdfinto%2Freport.pdfand breaks the links the existing test pins.How was this tested?
vitest run test/atoms/ChatFileDownload.test.tsxinpackages/trueforge-ui— 5 pass. Reverting only the encode call fails the new case and leaves the other four green.Checklist
format:checkpasses repo-wide and eslint is clean on the touched files; ran the package's own tests rather than the fullpnpm test. Repo-widelint:cihas 55 pre-existing errors, all inpackages/frontend/*andDropdownMenu.tsx, none in files this PR touches.env.example— not applicableChangeset included. On process: CONTRIBUTING asks for approval first, and all six
help wantedissues are assigned or already have PRs, so there was nothing approved to pick up. Close this if you'd rather it went through the queue.