[vszakats]

get_url_filename() percent-decodes a URL's final path segment and uses
it verbatim as curl's --output argument. A URL whose path ends in '-'
(literally or as '%2D') therefore yields exactly '-', which curl
treats as a request to write to stdout instead of a file. wcurl then
streams the downloaded body to the terminal, where escape sequences in
the response could be interpreted by the terminal emulator.

Make get_url_filename() return an empty string instead of '-', so the
existing "no filename found" fallback in exec_curl() picks the default
'index.html' the same way it already does for URLs with no path.

Reported-by: Joshua Rogers

[samueloph]

Could you add a few tests? This would suffice:

diff --git a/tests/tests.sh b/tests/tests.sh
--- a/tests/tests.sh
+++ b/tests/tests.sh
@@ -222,6 +222,28 @@ testUrlDefaultNameTrailingBackwardSlash()
     assertContains "Verify whether 'wcurl' chooses the correct default filename when there is no path in the URL and the URL ends with a backslash" "${ret}" 'index.html'
 }
 
+testUrlDefaultNameDash()
+{
+    url='example.com/-'
+    ret=$(${WCURL_CMD} ${url} 2>&1 | tr '\n' ' ')
+    assertContains "Verify whether 'wcurl' chooses the default filename when the filename in the URL is '-'" "${ret}" '--output index.html '
+
+    url='example.com/%2D'
+    ret=$(${WCURL_CMD} ${url} 2>&1 | tr '\n' ' ')
+    assertContains "Verify whether 'wcurl' chooses the default filename when the filename in the URL is a percent-encoded '-'" "${ret}" '--output index.html '
+
+    url='example.com/-'
+    ret=$(${WCURL_CMD} --no-decode-filename ${url} 2>&1 | tr '\n' ' ')
+    assertContains "Verify whether 'wcurl' chooses the default filename when the filename in the URL is '-' and --no-decode-filename is used" "${ret}" '--output index.html '
+}
+
+testUrlAllowDashWhenOutput()
+{
+    url='example.com/filename'
+    ret=$(${WCURL_CMD} ${url} -o - 2>&1 | tr '\n' ' ')
+    assertContains "Verify whether 'wcurl' allows writing to stdout when the output path is set by the user" "${ret}" '--output - '
+}
+
 testUrlDecodingWhitespace()
 {
     url='example.com/filename%20with%20spaces'

[samueloph]

Can you update the README file and manpage as well?

[vszakats]

It's not my patch, perhaps it was a mistake to just forward it like this.
Closing.

[samueloph]

It's not my patch, perhaps it was a mistake to just forward it like this.

No, you did the right thing, I don't mind making the changes myself if you're not available.

I've merged this as 8a1d388.

Thank you