MVC loading from stream

[IvanSammut]

I have a frame on an mvc view which I want to load the contents from a stream I am getting thru an Action.

The Action code is this

[HttpGet]
public ActionResult DownloadShipmentLabel2(Int64 fileID, bool inline = false)
{
clsConsignmentFilesHelper myHelper = null;
string sErrorMessage = null, sFileName = null;
try
{
sFileName = clsDBFunctions.GetFieldFromKey("CR_Consignment_Files", "ID", fileID, "FileName", ConnectionString.GetConnectionString(clsDefaults.eCompanyFunctionality.FedEx)).ToString();
if (!string.IsNullOrWhiteSpace(sFileName))
{
string mimeType = System.Web.MimeMapping.GetMimeMapping(sFileName);
myHelper = new clsConsignmentFilesHelper(ConnectionString.GetConnectionString(clsDefaults.eCompanyFunctionality.FedEx));
byte[] buffer = myHelper.DownloadConsignmentFileToBytes(fileID, "FedEx", out sErrorMessage);
if (buffer != null)
{
MemoryStream stream = new MemoryStream(buffer);
if (inline)
Response.AddHeader("Content-Disposition", $"inline; filename={sFileName}");
else
Response.AddHeader("Content-Disposition", $"attachment; filename={sFileName}");

                    return File(stream, mimeType);
                }
                else
                {
                    return new HttpStatusCodeResult(500, sErrorMessage);
                }
            }
            else
            {
                throw new Exception($"Could not retrieve the file name for the specified shipment labels ({fileID}).");
            }
        }
        catch (Exception ex)
        {
            clsDBFunctions.HandleError(ex, $"_downloadShipmentLabel({fileID})", "FedExController");
            return new HttpStatusCodeResult( 500, ex.Message);
        }
        finally
        {
            if (myHelper != null) myHelper = null;
        }
    } 

Then I have the following script to fill the frame with the pdf contents

function printConsignmentFile(fileID) {
const iframe = document.getElementById('viewer');

const pdfUrl =
    '/fedex/DownloadShipmentLabel2?fileID=' + fileID + '&inline=true';

iframe.src =
    '/pdfjs/web/viewer.html?file=' + pdfUrl + '&autoprint=1';

}

but I keep getting the following error in fetch_stream.js function fetchUrl

GET http://localhost:30114/fedex/DownloadShipmentLabel2%3FfileID%3D1316333 400 (Bad Request).

The url is fine cause when it is not inline the file is downloaded.

Can someone please help?
Thanks
Ivan

[Zorik0]

The request in your error shows two things going wrong at once:

GET /fedex/DownloadShipmentLabel2%3FfileID%3D1316333

1. The inline=true part never arrives. You build
   viewer.html?file=/fedex/DownloadShipmentLabel2?fileID=1316333&inline=true&autoprint=1
   so the viewer reads everything after the & as its own parameters. The file value ends at
   fileID=1316333, your Action gets inline=false, and it sends Content-Disposition: attachment.

2. The ? became %3F. Viewer versions before 6.3.289 re-encoded the file parameter, which turns
   the query string into part of the path (pdf.js issue [Bug]: Additional encoding or decoding of 'file' parameter of viewer.html breaks certain URLs to PDF files #20137, fixed by Don't re-encode the file parameter in the viewer #21718). ASP.NET then
   can't route /fedex/DownloadShipmentLabel2%3FfileID%3D..., hence the 400.

Fix the first by encoding the file URL before putting it in the viewer's query string:

function printConsignmentFile(fileID) {
  const pdfUrl = `/fedex/DownloadShipmentLabel2?fileID=${fileID}&inline=true`;
  document.getElementById("viewer").src =
    `/pdfjs/web/viewer.html?file=${encodeURIComponent(pdfUrl)}&autoprint=1`;
}

For the second, either upgrade the viewer to 6.3.289 or later, or avoid a query string in the
PDF URL entirely, which works on every version:

[HttpGet]
[Route("fedex/label/{fileID:long}")]
public ActionResult ShipmentLabel(long fileID) { /* same body, always inline */ }

iframe.src = `/pdfjs/web/viewer.html?file=${encodeURIComponent(`/fedex/label/${fileID}`)}`;

Since the viewer and the Action are on the same origin, the viewer's origin check
(validateFileURL) won't block it.