Merge pull request #27359 from nextcloud/backport/27354/stable21

[stable21] Escape filename in Content-Disposition

1 files changed, 25 insertions, 11 deletions

diff --git a/tests/lib/AppFramework/Http/DownloadResponseTest.php b/tests/lib/AppFramework/Http/DownloadResponseTest.php
index 6c509b8bc59..89de248cea0 100644
--- a/tests/lib/AppFramework/Http/DownloadResponseTest.php
+++ b/tests/lib/AppFramework/Http/DownloadResponseTest.php
@@ -30,22 +30,36 @@ class ChildDownloadResponse extends DownloadResponse {
 
 
 class DownloadResponseTest extends \Test\TestCase {
-
-	/**
-	 * @var ChildDownloadResponse
-	 */
-	protected $response;
-
 	protected function setUp(): void {
 		parent::setUp();
-		$this->response = new ChildDownloadResponse('file', 'content');
 	}
 
-
 	public function testHeaders() {
-		$headers = $this->response->getHeaders();
+		$response = new ChildDownloadResponse('file', 'content');
+		$headers = $response->getHeaders();
+
+		$this->assertEquals('attachment; filename="file"', $headers['Content-Disposition']);
+		$this->assertEquals('content', $headers['Content-Type']);
+	}
+
+	/**
+	 * @dataProvider filenameEncodingProvider
+	 */
+	public function testFilenameEncoding(string $input, string $expected) {
+		$response = new ChildDownloadResponse($input, 'content');
+		$headers = $response->getHeaders();
+
+		$this->assertEquals('attachment; filename="'.$expected.'"', $headers['Content-Disposition']);
+	}
 
-		$this->assertStringContainsString('attachment; filename="file"', $headers['Content-Disposition']);
-		$this->assertStringContainsString('content', $headers['Content-Type']);
+	public function filenameEncodingProvider() : array {
+		return [
+			['TestName.txt', 'TestName.txt'],
+			['A "Quoted" Filename.txt', 'A \\"Quoted\\" Filename.txt'],
+			['A "Quoted" Filename.txt', 'A \\"Quoted\\" Filename.txt'],
+			['A "Quoted" Filename With A Backslash \\.txt', 'A \\"Quoted\\" Filename With A Backslash \\\\.txt'],
+			['A "Very" Weird Filename \ / & <> " >\'""""\.text', 'A \\"Very\\" Weird Filename \\\\ / & <> \\" >\'\\"\\"\\"\\"\\\\.text'],
+			['\\\\\\\\\\\\', '\\\\\\\\\\\\\\\\\\\\\\\\'],
+		];
 	}
 }