Skip to content

[4.x] Prevent file download responses from leaking into action returns#10327

Open
joshhanley wants to merge 2 commits into
mainfrom
josh/file-download-returns
Open

[4.x] Prevent file download responses from leaking into action returns#10327
joshhanley wants to merge 2 commits into
mainfrom
josh/file-download-returns

Conversation

@joshhanley
Copy link
Copy Markdown
Member

The Scenario

A Livewire action can return a Laravel file download response. Livewire correctly converts the response into a download effect, but the original response object is also included in the action returns effect.

use Illuminate\Support\Facades\Storage;
use Livewire\Component;

class BugPlayground extends Component
{
    public function downloadFileDownloadWay()
    {
        return Storage::disk('local')->download(
            'livewire-downloads/test.txt',
            'test-download-way.txt',
            [
                'Content-Type' => 'text/plain',
            ]
        );
    }
}

The Problem

SupportFileDownloads detects StreamedResponse and BinaryFileResponse instances and converts them into a JSON-safe download effect.

However, HandleComponents::callMethods() still stores the original action return value in effects.returns. For file downloads, that means a Symfony response object can leak into the final Livewire JSON payload.

Returning null from the file-download hook is not enough with the current hook pipeline: component hook finish callbacks are used for side effects, and the event bus treats null as “keep the original forwarded value”.

The Solution

After method call hooks finish, Livewire now normalises StreamedResponse and BinaryFileResponse action returns to null before adding them to effects.returns.

The download effect remains the browser-facing instruction, and the returns array keeps a null entry so action return indexes stay aligned with the submitted calls.

Fixes #10326

Comment thread src/Mechanisms/HandleComponents/HandleComponents.php
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

File download responses are added to effects.returns and break JSON encoding

2 participants