From 078b825479c17f4be1bbe4a22ad4fbdeb3ec9abc Mon Sep 17 00:00:00 2001 From: Soren Date: Sat, 22 Aug 2026 13:41:13 +0200 Subject: [PATCH] fix(meshy): derive download extension from URL pathname Parse URL pathname basename instead of splitting the full URL string, so TLD segments and hash fragments no longer leak into filenames. Co-Authored-By: Soren Co-Authored-By: Cursor Composer 2.5 Co-authored-by: Cursor --- plugins/meshy/skills/meshy/scripts/meshy.mjs | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/plugins/meshy/skills/meshy/scripts/meshy.mjs b/plugins/meshy/skills/meshy/scripts/meshy.mjs index 3b4060d..07da196 100644 --- a/plugins/meshy/skills/meshy/scripts/meshy.mjs +++ b/plugins/meshy/skills/meshy/scripts/meshy.mjs @@ -622,9 +622,11 @@ async function pollTask(base, id, ctx, onProgress) { // ── Section 11: download ─────────────────────────────────────────────────── function extFromUrl(url, fallback) { try { - const clean = String(url).split('?')[0]; - const ext = clean.split('.').pop(); - return ext && ext.length <= 5 ? ext.toLowerCase() : fallback; + const base = new URL(String(url)).pathname.split('/').pop() || ''; + const dot = base.lastIndexOf('.'); + if (dot <= 0 || dot === base.length - 1) return fallback; + const ext = base.slice(dot + 1).toLowerCase(); + return /^[a-z0-9]{1,5}$/.test(ext) ? ext : fallback; } catch { return fallback; } } function sanitizeName(s) {