[ENG-2157] [Refix] Allow rx.download to resolve rx.get_upload_url

[masenf]

Update the special case in a way that works with the new Var system and its unstoppable determination to concatenate strings instead of using template string

This has been broken since 0.6.0, so a regression test was added to avoid future inadvertant breakage.

Fix #2812 (again)

Break it?

import reflex as rx


class State(rx.State):
    x: str

    def do_download(self):
        return rx.download(rx.get_upload_url(self.x))


def index() -> rx.Component:
    return rx.container(
        rx.color_mode.button(position="top-right"),
        rx.vstack(
            rx.heading("Welcome to XSSflex!", size="9"),
            rx.form(
                rx.input(
                    rx.input.slot(
                        rx.icon_button(
                            "x",
                            size="1",
                            type="button",
                            on_click=State.set_x(""),
                            variant="ghost",
                        ),
                    ),
                    placeholder="A filename to download?",
                    value=State.x,
                    on_change=State.set_x,
                ),
                rx.button("Download"),
                on_submit=State.do_download(),
            ),
        ),
        rx.logo(),
    )


app = rx.App()
app.add_page(index)

[masenf]

actually i just realized we can't merge this as is; since it's maybe creating a security problem for users that take whatever filename is given in the upload and potentially introduce script injection

[masenf]

actually, maybe it's okay... @adhami3310 any idea about the script injection with this?

i tried the following

return rx.download(rx.get_upload_url('`${window.alert("foo")}`'))

return rx.download(rx.get_upload_url('"; window.alert("foo"); "'))

and both of those had proper escapes around the danger characters