pippo
pippo copied to clipboard
Response filename not escaped in Content-Disposition Header
Related to #344 and #344
public Response filenameHeader(String filename) {
if (filename != null && !filename.isEmpty()) {
header(HttpConstants.Header.CONTENT_DISPOSITION, "attachment; filename=\"" + filename + "\"");
} else {
header(HttpConstants.Header.CONTENT_DISPOSITION, "attachment; filename=\"\"");
}
return this;
}
Does not escape the filename.
For example " inside it will break header parsing for the client.
See https://stackoverflow.com/questions/93551/how-to-encode-the-filename-parameter-of-content-disposition-header-in-http
Also FileItem does not un-escape the filename upon reading the Content-Disposition Header.
@lambdaupb Can you supply a PR with a solution to this problem? Thanks!