-
-
Notifications
You must be signed in to change notification settings - Fork 704
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Make it possible to download BLOB data from the Datasette UI #1036
Comments
Twitter thread: https://twitter.com/dancow/status/1318681053347840005 |
From https://hackerone.com/reports/126197:
So you do have to be careful not to open accidental XSS holes with From that thread it looks like the solution is to add a |
|
I can also use a |
I think this plus the binary-CSV stuff in #1034 will justify a dedicated section of the documentation to talk about how Datasette handles binary BLOB columns. |
Extra security idea: a |
Possible URL for this: |
What should the suggested filename be? I think something that includes the table name, primary key and the name of the column would work. How about a file extension? I guess |
Actually I like |
So for https://latest.datasette.io/fixtures/binary_data the BLOB download URLs would be:
With these headers:
|
Should this work just for BLOB columns, or should it work for other columns too? For the moment I'm going to restrict it to BLOBs, since data from other columns is available through the UI whereas BLOB columns are not. |
Another useful demo database: https://datasette-render-images-demo.datasette.io/favicons/favicons - see https://datasette-render-images-demo.datasette.io/favicons/favicons.csv |
This code needs these permission checks: datasette/datasette/views/table.py Lines 911 to 913 in bf82b3d
|
Hi Simon Just finding this old issue regarding downloading blobs. Nice work! As a feature request, maybe it would be possible to assign a blob column as a certain data type (e.g. I guess the column blob-type definition could fit into this dropdown selection: Let me know if I should open a new issue with a feature request. (This could slowly go in the direction of displaying image blob-types in the browser.) Thanks for the great tool! edit: just reading the rest of the twitter thread: https://twitter.com/simonw/status/1318685933256855552 perhaps this is already possible in some form with the plugin datasette-media: https://github.com/simonw/datasette-media |
As you can see, I'm pretty paranoid about serving content with You found Maybe even an output plugin? |
It might be possible with this library: https://docs.python.org/3/library/imghdr.html quick test of the downloaded blob:
The output plugin would be cool. I'll look into making my first datasette plugin. I'm also imagining displaying the image in the browser -- but that would be a step 2. |
Currently you can only extract binary BLOB data as base64-encoded JSON, which is not user friendly at all. It should always be possible for end-users to get the binary data out.
I'm worried about XSS vulnerabilities here, but hopefully sending
Content-Type: application/octet-stream
helps there? Need to research that.The text was updated successfully, but these errors were encountered: