Skip to content

feat(download): optional Node save-to-disk sink (with filename sanitization) #453

Description

@rejifald

@stitchapi/download is browser-first: it resolves each item to a Blob and never touches disk, so the same code runs in Node and the browser. A Node-only, opt-in helper to persist a batch to disk is a natural follow-up — kept off the isomorphic core path.

Proposal

A separate Node-gated subpath (e.g. @stitchapi/download/node) that streams/saves results to a directory. It must:

  • Sanitize the filename before any FS use. Core returns the Content-Disposition / URL-derived filename as-is — it can be ../../etc/passwd, ..\\..\\, C:\\…, or contain CRLF (rig H11 / X20). Basename + resolve/reject traversal before writing.
  • Handle collisions (two items → same name) and surface ENOSPC / write errors as per-item failures (rig §2.10 — explicitly out of scope for the Blob surface).
  • Stay behind a conditional export so the main entry stays browser-safe (no static node:*).

References

Rig spec §2.10, H11 / X20, §2.1 filename edges. Introduced alongside #451.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions