ASCII encode ContentDisposition file name

Signed-off-by: Maxim Nesen <[email protected]>
senivam · Jan 23, 2024 · a486428 · a486428
1 parent e4c3bf5
commit a486428
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 6 deletions.
diff --git a/media/multipart/src/main/java/org/glassfish/jersey/media/multipart/ContentDisposition.java b/media/multipart/src/main/java/org/glassfish/jersey/media/multipart/ContentDisposition.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, 2023 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2010, 2024 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -28,8 +28,6 @@
 import org.glassfish.jersey.message.internal.HttpHeaderReader;
 import org.glassfish.jersey.uri.UriComponent;
 
-import javax.ws.rs.core.HttpHeaders;
-
 /**
  * A content disposition header.
  *
@@ -63,7 +61,7 @@ public class ContentDisposition {
     protected ContentDisposition(final String type, final String fileName, final Date creationDate,
                                  final Date modificationDate, final Date readDate, final long size) {
         this.type = type;
-        this.fileName = fileName;
+        this.fileName = encodeAsciiFileName(fileName);
         this.creationDate = creationDate;
         this.modificationDate = modificationDate;
         this.readDate = readDate;
@@ -211,6 +209,24 @@ protected void addLongParameter(final StringBuilder sb, final String name, final
         }
     }
 
+    protected String encodeAsciiFileName(String fileName) {
+        if (fileName == null
+                || (fileName.indexOf('"') == -1
+                && fileName.indexOf('\\') == -1)) {
+            return fileName;
+        }
+
+        final StringBuilder encodedBuffer = new StringBuilder();
+        fileName.chars().forEach(x -> {
+            char c = (char) x;
+            if (c == '"' || c == '\\') {
+                encodedBuffer.append('\\');
+            }
+            encodedBuffer.append(c);
+        });
+        return encodedBuffer.toString();
+    }
+
     private void createParameters() throws ParseException {
         defineFileName();
 
@@ -229,7 +245,7 @@ private void defineFileName() throws ParseException {
         final String fileNameExt = parameters.get("filename*");
 
         if (fileNameExt == null) {
-            this.fileName = fileName;
+            this.fileName = encodeAsciiFileName(fileName);
             return;
         }
 

diff --git a/tests/e2e/src/test/java/org/glassfish/jersey/tests/api/ContentDispositionTest.java b/tests/e2e/src/test/java/org/glassfish/jersey/tests/api/ContentDispositionTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2023 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2024 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -88,6 +88,14 @@ public void testCreate() {
         }
     }
 
+    @Test
+    void testContentDispositionEncoded() {
+        final Date date = new Date();
+        final ContentDisposition contentDisposition = ContentDisposition.type(contentDispositionType).fileName("\"rm\\ -rf\".sh")
+                .creationDate(date).modificationDate(date).readDate(date).size(312).build();
+        assertEquals("\\\"rm\\\\ -rf\\\".sh", contentDisposition.getFileName());
+    }
+
     @Test
     public void testToString() {
         final Date date = new Date();