Keep URL extension fallback safe and compatible

Author: rahulshahDEV

flutter_cache_manager/CHANGELOG.md

@@ -1,6 +1,6 @@
 ## [3.4.6] - 2026-10-25
 
-* Preserves the URL file extension when a download response omits its content type or uses `application/octet-stream` ([#489](https://github.com/Baseflow/flutter_cache_manager/issues/489)).
+* Preserves safe URL file extensions when a download response omits its content type or uses `application/octet-stream` ([#489](https://github.com/Baseflow/flutter_cache_manager/issues/489)).
 
 ## [3.4.5] - 2026-09-18
 

flutter_cache_manager/lib/src/compat/file_service_compat.dart

@@ -21,10 +21,10 @@ class FileServiceCompat extends FileService {
 
 class CompatFileServiceGetResponse implements FileServiceResponse {
   final FileFetcherResponse legacyResponse;
-  final Uri _uri;
+  final Uri? _uri;
   final DateTime _receivedTime = clock.now();
 
-  CompatFileServiceGetResponse(this.legacyResponse, this._uri);
+  CompatFileServiceGetResponse(this.legacyResponse, [this._uri]);
 
   String? _header(String name) {
     return legacyResponse.header(name);

flutter_cache_manager/lib/src/web/file_service.dart

@@ -66,12 +66,13 @@ abstract class FileServiceResponse {
 
 /// Basic implementation of a [FileServiceResponse] for http requests.
 class HttpGetResponse implements FileServiceResponse {
-  HttpGetResponse(this._response, this._uri);
+  HttpGetResponse(this._response, [Uri? uri])
+    : _uri = uri ?? _response.request?.url;
 
   final DateTime _receivedTime = clock.now();
 
   final http.StreamedResponse _response;
-  final Uri _uri;
+  final Uri? _uri;
 
   @override
   int get statusCode => _response.statusCode;

flutter_cache_manager/lib/src/web/mime_converter.dart

@@ -5,7 +5,11 @@ extension ContentTypeConverter on ContentType {
   String get fileExtension => mimeTypes[mimeType] ?? '.$subType';
 }
 
-String fileExtensionFromContentTypeOrUri(String? contentTypeHeader, Uri uri) {
+final RegExp _invalidFileExtensionCharacters = RegExp(
+  r'[\x00-\x1f\x7f/\\:*?"<>|]',
+);
+
+String fileExtensionFromContentTypeOrUri(String? contentTypeHeader, Uri? uri) {
   final contentType = contentTypeHeader == null
       ? null
       : ContentType.parse(contentTypeHeader);
@@ -15,10 +19,17 @@ String fileExtensionFromContentTypeOrUri(String? contentTypeHeader, Uri uri) {
     return contentType.fileExtension;
   }
 
-  final fileName = uri.pathSegments.isEmpty ? '' : uri.pathSegments.last;
+  final pathSegments = uri?.pathSegments;
+  final fileName = pathSegments == null || pathSegments.isEmpty
+      ? ''
+      : pathSegments.last;
   final extensionIndex = fileName.lastIndexOf('.');
   if (extensionIndex > 0 && extensionIndex < fileName.length - 1) {
-    return fileName.substring(extensionIndex);
+    final extension = fileName.substring(extensionIndex);
+    if (!_invalidFileExtensionCharacters.hasMatch(extension) &&
+        !extension.endsWith(' ')) {
+      return extension;
+    }
   }
 
   return contentType?.fileExtension ?? '';

flutter_cache_manager/test/http_file_fetcher_test.dart

@@ -80,6 +80,19 @@ void main() {
       expect(response.fileExtension, '.$fileExtension');
     });
 
+    test('HttpGetResponse keeps its original one-argument constructor', () {
+      final response = HttpGetResponse(
+        StreamedResponse(
+          const Stream<List<int>>.empty(),
+          200,
+          headers: {'content-type': 'application/octet-stream'},
+          request: Request('GET', Uri.parse('https://example.com/video.mp4')),
+        ),
+      );
+
+      expect(response.fileExtension, '.mp4');
+    });
+
     test('Download uses the URL extension for generic content type', () async {
       const url = 'https://example.com/video.mp4?token=secret';
       final client = MockClient((_) async {
@@ -177,6 +190,32 @@ void main() {
       expect(response.fileExtension, '.bin');
     });
 
+    test(
+      'Encoded path separators are not used in cached file extensions',
+      () async {
+        const url = 'https://example.com/video.mp4%2Fpart';
+        final client = MockClient((_) async {
+          return Response.bytes(
+            Uint8List(16),
+            200,
+            headers: {'content-type': 'application/octet-stream'},
+          );
+        });
+        final cacheManager = CacheManager(
+          Config(
+            'test',
+            fileSystem: TestFileSystem(),
+            repo: MockCacheInfoRepository(),
+            fileService: HttpFileService(httpClient: client),
+          ),
+        );
+
+        final result = await cacheManager.downloadFile(url);
+
+        expect(result.file.path, endsWith('.bin'));
+      },
+    );
+
     test('Test CompatFileService', () async {
       var eTag = 'test';
       var fileExtension = 'jpg';