root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Encode non-printable character in Content-Disposition parameter 

Prior to this commit, the "filename" parameter value for the
"Content-Disposition" header would contain non-printable characters,
causing parsing issues for HTTP clients.
This commit ensures that all non-printable characters are encoded.

Fixes gh-35035
This commit is contained in:
Brian Clozel 2025-06-12 08:39:41 +02:00
parent 28caa39020
commit fd68ea6fcb
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
spring-web/src/main/java/org/springframework/http/ContentDisposition.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2023 the original author or authors. * Copyright 2002-2025 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -67,6 +67,7 @@ public final class ContentDisposition {
for (int i=33; i<= 126; i++) { for (int i=33; i<= 126; i++) {
PRINTABLE.set(i); PRINTABLE.set(i);
} }
PRINTABLE.set(34, false); // "
PRINTABLE.set(61, false); // = PRINTABLE.set(61, false); // =
PRINTABLE.set(63, false); // ? PRINTABLE.set(63, false); // ?
PRINTABLE.set(95, false); // _ PRINTABLE.set(95, false); // _

9
spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2024 the original author or authors. * Copyright 2002-2025 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -305,6 +305,13 @@ class ContentDispositionTests {
tester.accept("foo.txt\\\\\\", "foo.txt\\\\\\\\\\\\"); tester.accept("foo.txt\\\\\\", "foo.txt\\\\\\\\\\\\");
} }
@Test
void formatWithUtf8FilenameWithQuotes() {
String filename = "\"中文.txt";
assertThat(ContentDisposition.formData().filename(filename, StandardCharsets.UTF_8).build().toString())
.isEqualTo("form-data; filename=\"=?UTF-8?Q?=22=E4=B8=AD=E6=96=87.txt?=\"; filename*=UTF-8''%22%E4%B8%AD%E6%96%87.txt");
}
@Test @Test
void formatWithEncodedFilenameUsingInvalidCharset() { void formatWithEncodedFilenameUsingInvalidCharset() {
assertThatIllegalArgumentException().isThrownBy(() -> assertThatIllegalArgumentException().isThrownBy(() ->