Fix issue2777: prevent filenames with relative paths

[keflavich]

WIP - first commit (3222132) addresses the possibility that filename= given in the Content-Disposition header could contain a full path and could be used to overwrite pickle files in the cache directories.

See issue #2777 for more info

[codecov]

Codecov Report

❗ No coverage uploaded for pull request base (main@6f7ae8b). Click here to learn what that means.
The diff coverage is 57.14%.

❗ Current head c1bb7bd differs from pull request most recent head 9da4965. Consider uploading reports for the commit 9da4965 to get more accurate results

@@           Coverage Diff           @@
##             main    #2779   +/-   ##
=======================================
  Coverage        ?   66.09%           
=======================================
  Files           ?      235           
  Lines           ?    18073           
  Branches        ?        0           
=======================================
  Hits            ?    11946           
  Misses          ?     6127           
  Partials        ?        0           

Files Changed	Coverage Δ
astroquery/esa/iso/core.py	64.58% <50.00%> (ø)
astroquery/esa/xmm_newton/core.py	64.56% <50.00%> (ø)
astroquery/utils/tap/conn/tapconn.py	47.44% <50.00%> (ø)
astroquery/alma/core.py	55.57% <100.00%> (ø)

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[ceb8]

LGTM

[bsipocz]

@keflavich - could you please rebase?

[keflavich]

done. Code style failures are all unrelated. Did you enable more aggressive checks recently? I'll be happy to fix them, as they're all easy, but they don't apply to this PR

[bsipocz]

done. Code style failures are all unrelated. Did you enable more aggressive checks recently? I'll be happy to fix them, as they're all easy, but they don't apply to this PR

Nope no recent updates, I suppose it maybe due to a flake8 version change? Agree to address it separately.

[bsipocz]

Either case, it's annoying that the rest of the tests are cancelled, so I'll remove that separately, too.

[bsipocz]

Thanks @keflavich!

[eerovaher]

The title of this pull request says that it fixes #2777, but the issue is still open despite the pull request being merged. Should the issue be closed or is the title here wrong?

[bsipocz]

Issue #2777 has other components that haven't been addressed here, thus it is still open.

[eerovaher]

In that case it would be good to rename this pull request so that it wouldn't be misleading.