Merge pull request #33829 from mtsmfm/encode-filename

Encode Content-Disposition filenames on send_data and send_file

2 files changed, 39 insertions, 2 deletions

diff --git a/actionpack/test/controller/send_file_test.rb b/actionpack/test/controller/send_file_test.rb
index 7b1a52b277..c917cdf761 100644
--- a/actionpack/test/controller/send_file_test.rb
+++ b/actionpack/test/controller/send_file_test.rb
@@ -144,7 +144,7 @@ class SendFileTest < ActionController::TestCase
       get :test_send_file_headers_bang
 
       assert_equal "image/png", response.content_type
-      assert_equal 'disposition; filename="filename"', response.get_header("Content-Disposition")
+      assert_equal %(disposition; filename="filename"; filename*=UTF-8''filename), response.get_header("Content-Disposition")
       assert_equal "binary", response.get_header("Content-Transfer-Encoding")
       assert_equal "private", response.get_header("Cache-Control")
     end
@@ -153,7 +153,7 @@ class SendFileTest < ActionController::TestCase
   def test_send_file_headers_with_disposition_as_a_symbol
     get :test_send_file_headers_with_disposition_as_a_symbol
 
-    assert_equal 'disposition; filename="filename"', response.get_header("Content-Disposition")
+    assert_equal %(disposition; filename="filename"; filename*=UTF-8''filename), response.get_header("Content-Disposition")
   end
 
   def test_send_file_headers_with_mime_lookup_with_symbol
diff --git a/actionpack/test/dispatch/content_disposition_test.rb b/actionpack/test/dispatch/content_disposition_test.rb
new file mode 100644
index 0000000000..3f5959da6e
--- /dev/null
+++ b/actionpack/test/dispatch/content_disposition_test.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "abstract_unit"
+
+module ActionDispatch
+  class ContentDispositionTest < ActiveSupport::TestCase
+    test "encoding a Latin filename" do
+      disposition = Http::ContentDisposition.new(disposition: :inline, filename: "racecar.jpg")
+
+      assert_equal %(filename="racecar.jpg"), disposition.ascii_filename
+      assert_equal "filename*=UTF-8''racecar.jpg", disposition.utf8_filename
+      assert_equal "inline; #{disposition.ascii_filename}; #{disposition.utf8_filename}", disposition.to_s
+    end
+
+    test "encoding a Latin filename with accented characters" do
+      disposition = Http::ContentDisposition.new(disposition: :inline, filename: "råcëçâr.jpg")
+
+      assert_equal %(filename="racecar.jpg"), disposition.ascii_filename
+      assert_equal "filename*=UTF-8''r%C3%A5c%C3%AB%C3%A7%C3%A2r.jpg", disposition.utf8_filename
+      assert_equal "inline; #{disposition.ascii_filename}; #{disposition.utf8_filename}", disposition.to_s
+    end
+
+    test "encoding a non-Latin filename" do
+      disposition = Http::ContentDisposition.new(disposition: :inline, filename: "автомобиль.jpg")
+
+      assert_equal %(filename="%3F%3F%3F%3F%3F%3F%3F%3F%3F%3F.jpg"), disposition.ascii_filename
+      assert_equal "filename*=UTF-8''%D0%B0%D0%B2%D1%82%D0%BE%D0%BC%D0%BE%D0%B1%D0%B8%D0%BB%D1%8C.jpg", disposition.utf8_filename
+      assert_equal "inline; #{disposition.ascii_filename}; #{disposition.utf8_filename}", disposition.to_s
+    end
+
+    test "without filename" do
+      disposition = Http::ContentDisposition.new(disposition: :inline, filename: nil)
+
+      assert_equal "inline", disposition.to_s
+    end
+  end
+end