arturobernalg opened a new pull request, #571: URL: https://github.com/apache/jspwiki/pull/571
JSPWIKI-922 AttachmentServlet wrote the name of an attachment as it is inside the quoted filename parameter of Content-Disposition. On a running instance (Tomcat 10.1, current master) an attachment named Täst.txt was served with `Content-Disposition: inline; filename="T\xE4st.txt";`, that is one raw 0xE4 byte, which is not valid UTF-8. The header was the same over HTTP/1.1 and over HTTP/2. A name that contains a quote or a backslash also ended the quoted string. A name with a character outside printable ASCII, a quote or a backslash now gets an ASCII fallback in filename and the UTF-8 name, percent encoded, in filename* (RFC 6266, RFC 8187): `filename="T_st.txt"; filename*=UTF-8''T%C3%A4st.txt;`. Names made of printable ASCII characters are written as before. Tests: 8 new tests in AttachmentServletTest. They do not compile on master, because encodeFileName does not exist there. AttachmentServletTest (10 tests), AttachmentManagerTest (14) and BasicAttachmentProviderTest (13) pass. On a running instance with this change, an attachment with an umlaut, one with a Chinese name and one with a quote in the name were downloaded with status 200 over HTTP/1.1 and over HTTP/2 without TLS, with the new header. Not tested: Firefox and HTTP/2 over TLS. A comment on JSPWIKI-922 reports a network error when a file with umlauts in its name is downloaded in Firefox; it is not known whether this change affects that error. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
