Skip to content

Commit fd68ea6

Browse files
committed
Encode non-printable character in Content-Disposition parameter
Prior to this commit, the "filename" parameter value for the "Content-Disposition" header would contain non-printable characters, causing parsing issues for HTTP clients. This commit ensures that all non-printable characters are encoded. Fixes gh-35035
1 parent 28caa39 commit fd68ea6

File tree

2 files changed

+10
-2
lines changed

2 files changed

+10
-2
lines changed

spring-web/src/main/java/org/springframework/http/ContentDisposition.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2023 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -67,6 +67,7 @@ public final class ContentDisposition {
6767
for (int i=33; i<= 126; i++) {
6868
PRINTABLE.set(i);
6969
}
70+
PRINTABLE.set(34, false); // "
7071
PRINTABLE.set(61, false); // =
7172
PRINTABLE.set(63, false); // ?
7273
PRINTABLE.set(95, false); // _

spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -305,6 +305,13 @@ void formatWithFilenameWithQuotes() {
305305
tester.accept("foo.txt\\\\\\", "foo.txt\\\\\\\\\\\\");
306306
}
307307

308+
@Test
309+
void formatWithUtf8FilenameWithQuotes() {
310+
String filename = "\"中文.txt";
311+
assertThat(ContentDisposition.formData().filename(filename, StandardCharsets.UTF_8).build().toString())
312+
.isEqualTo("form-data; filename=\"=?UTF-8?Q?=22=E4=B8=AD=E6=96=87.txt?=\"; filename*=UTF-8''%22%E4%B8%AD%E6%96%87.txt");
313+
}
314+
308315
@Test
309316
void formatWithEncodedFilenameUsingInvalidCharset() {
310317
assertThatIllegalArgumentException().isThrownBy(() ->

0 commit comments

Comments
 (0)