When using the 'Install from URL' (or any extension using that functionality), downloads the package file, it will try to find a suitable file name to use to store in the tmp folder.
In most cases the filename is taken from the header information from the file.

However, if that information is not available, it will try to create a filename based on the url.
It does this using the getFilenameFromUrl() method.

So if the file is:

https://www.some-domain.com/downloads/foobar.zip

Then the filename will be foobar.zip.

That's all great.
However, what if the url is:

https://www.some-domain.com/downloads/file.php?file=foobar

Then the filename will be file.php?file=foobar.
Or even worse:

https://www.some-domain.com/downloads/?file=foobar

Will result in the filename ?file=foobar.

If this happens, then the next step in the process, the unpacking of the package, will fail miserably. As the special characters in the filename will cause kittens to die.

But there is another issue with the getFilenameFromUrl() method.
It is only used by the parent InstallerHelper class code (even though it is a public method).
And this is the code where it is used:

$target = $tmpPath . '/' . self::getFilenameFromUrl($url);

But the getFilenameFromUrl() method will return a false if it can't find a filename for whatever reason.
So that would result in the filename 'false'... Not good.

Summary of Changes

So the PR makes the whole getFilenameFromUrl() method smarter.

1. It will trim and replace any special characters with underscores.
   So https://www.some-domain.com/downloads/?file=foobar will result in file_foobar.
2. It will fall back to and return a unique id (like ``) if there is no file name found for whatever reason.

Testing Instructions

This is hard to test in real life, as this code only gets triggered when stuff is not as it should be (no correct header information and such).
So probably best to test this through test suits passing dummy (fake) data to it.
If you can do that, I don't have to explain :)

Documentation Changes Required

https://api.joomla.org/cms-3/classes/Joomla.CMS.Installer.InstallerHelper.html
The return value of the getFilenameFromUrl() mothod has changed, as it now will always return a string. No more false value.
So:

getFilenameFromUrl(string $url) : mixed

Becomes:

getFilenameFromUrl(string $url) : string

And:

Response
mixed String filename or boolean false if failed

Becomes:

Response
string Clean version of the filename or a unique id