[jira] [Resolved] (WICKET-6010) Downloading filenames containing ',' or ';' gives problems

["Sven Meier (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WICKET-6010?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sven Meier resolved WICKET-6010.
--------------------------------
       Resolution: Fixed
    Fix Version/s: 8.0.0-M1
                   7.2.0

We have a specific encoder instance for header values now.

> Downloading filenames containing ',' or ';' gives problems
> ----------------------------------------------------------
>
>                 Key: WICKET-6010
>                 URL: https://issues.apache.org/jira/browse/WICKET-6010
>             Project: Wicket
>          Issue Type: Bug
>          Components: wicket
>    Affects Versions: 7.0.0
>            Reporter: Laurens Hop
>            Assignee: Sven Meier
>             Fix For: 7.2.0, 8.0.0-M1
>
>
> Since WICKET-4934 the "filename" in the Content-Disposition header is encoded in both ASCII and UTF-8 to show the filename in a cross browser compatible way. However, the implementation is not completely correct, and specifically causes problems when the filename contains ',' or ';' characters. Depending on the browser, the characters after the ',' or ';' are ignored, or an error is throwed.
> Downloading of a file "Test; 'ä'.txt" gives the following Content-Disposition header:
> {code}
> attachment; filename="Test;%20%27%C3%A4%27.txt"; filename*=UTF-8''Test;%20%27%C3%A4%27.txt
> {code}
> I am not completely familiar with the standards and current browser support, but http://greenbytes.de/tech/tc2231/ suggests that the ASCII "filename" field should not be URL encoded, just specified using plain ISO-8859-1, surrounded by double quotes, escaping double quotes by '\'. But this is not my biggest concern.
> The UTF-8 "filename*" field is (correctly) not surrounded by quotes. As a result, all characters except ALPHA / DIGIT / "!" / "#" / "$" / "&" / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~" [should be URL encoded|https://tools.ietf.org/html/rfc5987#section-3.2.1]. This includes ',' and ';'. Wicket's (PATH) UrlEncoder however does not encode '*', ',', ':', '@', '=' and ';'. Not encoding the ';' or ',' causes browsers to ignore the remainder of the filename or even to throw errors.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)