fix: download responses not working

[gupta-piyush19]

What does this PR do?

fix download responses not working

Fixes #2199

How should this be tested?

• Download response file for a survey having no surveys
• Download response file for a survey having / in the survey name

Checklist

Required

• Filled out the "How to test" section in this PR
• Read How we Code at Formbricks
• Self-reviewed my own code
• Commented on my code in hard-to-understand bits
• Ran pnpm build
• Checked for warnings, there are none
• Removed all console.logs
• Merged the latest changes from main onto my branch with git pull origin main
• My changes don't cause any responsiveness issues

Appreciated

• If a UI change was made: Added a screen recording or screenshots to this PR
• Updated the Formbricks Docs if changes were necessary

[vercel]

@gupta-piyush19 is attempting to deploy a commit to the formbricks Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Thank you for following the naming conventions for pull request titles! 🙏

[mattinannt]

@gupta-piyush19 thank you, looks great! 😊💪

[jonas-hoebenreich]

Many thanks for the quick fix. I would suggest to make the function getResponsesFileName even more robust against path traversal attacks (e.g. a user could download files he should not have access to)?

export const getResponsesFileName = (surveyName: string, extension: string) => {
  // sanitize surveyName by removing all characters from the survey name that could cause issues & add max length
  surveyName = surveyName.replace(/[^0-9a-zA-Z\-._]+/g, "_").substring(0, 255);
  const formattedDateString = getTodaysDateTimeFormatted("-");
  return `export-${surveyName.split(" ").join("-")}-${formattedDateString}.${extension}`.toLocaleLowerCase();
};

[jonas-hoebenreich]

I would suggest to make the function getResponsesFileName even more robust against path traversal attacks by removing all characters from the filename that could cause issues and also limit the length of the name (to resolve OS specific issues with really long file names)

[jonas-hoebenreich]

// sanitize surveyName by removing all characters from the survey name that could cause issues & add max length
surveyName = surveyName.replace(/[^0-9a-zA-Z\-._]+/g, "_").substring(0, 255);

[gupta-piyush19]

Yes, it makes sense. Thank you for the suggestions. I'll update the PR with this new filename function.