diff options
author | Kim Alvefur <zash@zash.se> | 2022-01-29 16:11:38 +0100 |
---|---|---|
committer | Kim Alvefur <zash@zash.se> | 2022-01-29 16:11:38 +0100 |
commit | ca19260145f1bfea476329f2939fe9e46e09a5a6 (patch) | |
tree | de1b6dd724079ab125c8a54e86e97d7f28db7c86 /net/http/server.lua | |
parent | 46ad556ca0fc5b3faf41d1d94d1f3aab60cc728f (diff) | |
download | prosody-ca19260145f1bfea476329f2939fe9e46e09a5a6.tar.gz prosody-ca19260145f1bfea476329f2939fe9e46e09a5a6.zip |
mod_http_file_share: Use alternate syntax for filename in Content-Disposition
The Lua string.format %q doesn't behave correctly for all characters
that should be escaped in a quoted-string. And who knows what effects
higher Unicode might have here.
Applying percent-encoding of filenames seems like the safest way to deal
with filenames, as well as being easier than implementing the actual
quoted-string transform, which seems complicated and I'm not even sure
it covers every possible character.
Filenames can safely be assumed to be UTF-8 since they are passed in an
attribute in the query without any escaping.
Diffstat (limited to 'net/http/server.lua')
0 files changed, 0 insertions, 0 deletions