startproject and startapp do not sanitize filename from Content-Disposition header

[Natalia Bidart]

When using django-admin startproject or startapp with a remote --template URL, the download logic trusts the filename value from the HTTP Content-Disposition header and uses it directly to construct a filesystem path.

In TemplateCommand.download(), the header-provided filename is joined with the temporary download directory and passed to shutil.move() without normalization. The filename is not sanitized, allowing the downloaded file to be written outside the command’s designated temporary download directory.

This occurs before archive validation or extraction and affects only local development workflows using remote templates, which are documented to require full audit before use (​https://docs.djangoproject.com/en/6.0/ref/django-admin/#cmdoption-startapp-template).

Still, the expected behavior is that downloaded template archives should always remain confined to the temporary download directory, regardless of header-provided filenames.

[ar3ph]

I can take a look at this.

[ar3ph]

Here is a patch for the filename from Content-Disposition header: ​https://github.com/django/django/pull/20639

Do I need to update/add a test though? I can't find any existing tests for the template command.

[Natalia Bidart]

Replying to ar3ph:

Do I need to update/add a test though? I can't find any existing tests for the template command.

Yes, most definitely. Existing tests are located in ​https://github.com/django/django/blob/main/tests/admin_scripts/tests.py

Setting the flags per PR comments.

[ar3ph]

I have updated the code, added a test and updated the release doc: ​https://github.com/django/django/pull/20639

[ar3ph]

Ready for review: ​https://github.com/django/django/pull/20639

[Jacob Walls]

Submitted patch looks in good shape, I added small cosmetic edits in a new ​PR to prepare to land.

[Jacob Walls <jacobtylerwalls@…>]

In 46c5e76:

Fixed #36900 -- Used safe_join() on downloaded template archive.

[Jacob Walls <jacobtylerwalls@…>]

In 74ce178:

[6.1.x] Fixed #36900 -- Used safe_join() on downloaded template archive.

Backport of 46c5e76f0bcc76bfce19ad7ba07f716fc653a822 from main.