@ai-matrx/design-system 0.18.3 → 0.18.4

package/dist/data-table/data-row-inspector.js

@@ -1514,6 +1514,7 @@ var actionDone = (message) => ({
   mimeTypes: [],
   message
 });
+var isSafeFilename = (filename) => filename === filename.trim() && filename.length > 0 && !/^\.+$/.test(filename) && !/[\\/\x00-\x1F\x7F]/.test(filename);
 var sourceFor = (id, label, build) => ({
   id,
   label,
@@ -1662,7 +1663,8 @@ function MatrxCopyMenuSession(props) {
                 value: {
                   bytes: Array.from(bytes),
                   mime: file.mime,
-                  extension: file.extension
+                  extension: file.extension,
+                  ...file.filename !== void 0 ? { filename: file.filename } : {}
                 }
               };
             },
@@ -1679,12 +1681,16 @@ function MatrxCopyMenuSession(props) {
             (byte) => typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255
           ))
             throw new Error(`${item.label} did not capture a valid file.`);
+          if (value.filename !== void 0 && (typeof value.filename !== "string" || !isSafeFilename(value.filename)))
+            throw new Error(
+              `${item.label} has an unsafe filename. Use a nonempty basename without leading or trailing whitespace, dots only, path separators, or control characters.`
+            );
           if (draft.omissions.some((omission) => omission.reason !== "duplicate"))
             throw new Error(
               "This custom file exceeds the configured export limits or contains excluded content. Use a standard format or revise the source options."
             );
           const bytes = new Uint8Array(value.bytes);
-          const filename = `${props.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "export"}.${value.extension.replace(/[^a-zA-Z0-9.-]/g, "") || "bin"}`;
+          const filename = typeof value.filename === "string" ? value.filename : `${props.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "export"}.${value.extension.replace(/[^a-zA-Z0-9.-]/g, "") || "bin"}`;
           return transport.download(
             sealTransferArtifact2({
               snapshotId: snapshot.id,