Add filename* for a download name past ASCII

The plain, snapshot and blob pages sent a name such as café.txt raw in
filename, which a client may read as ISO-8859-1. RFC 6266 has such a
name sent again as filename*, percent-encoded in UTF-8, for a client
that knows the form, with filename first for one that does not. The
extended form carries UTF-8 alone, so a name that is not valid UTF-8
keeps the plain filename by itself.

5 files changed, 97 insertions, 4 deletions

diff --git a/source/html.c b/source/html.cindex ce9344d..00eb7c6 100644--- a/source/html.c+++ b/source/html.c@@ -471,6 +471,26 @@ void html_header_arg_in_quotes(const char *txt) 		html(txt); } +void html_header_ext_value(const char *txt)+{+	const char *p = txt;++	while (p && *p) {+		unsigned char c = *p;++		// The attr-char set of RFC 8187, which leaves nothing that+		// could end the parameter or the header line.+		if (!isalnum(c) && !strchr("!#$&+-.^_`|~", c)) {+			html_raw(txt, p - txt);+			htmlf("%%%02X", c);+			txt = p + 1;+		}+		p++;+	}+	if (p != txt)+		html(txt);+}+ /*  * A query string goes into a header the way it arrived, already encoded by  * the client, except that a byte a header line cannot carry is percent-encoded
diff --git a/source/html.c b/source/html.c
index ce9344d..00eb7c6 100644
--- a/source/html.c
+++ b/source/html.c
@@ -471,6 +471,26 @@ void html_header_arg_in_quotes(const char *txt)
 		html(txt);
 }
 
+void html_header_ext_value(const char *txt)
+{
+	const char *p = txt;
+
+	while (p && *p) {
+		unsigned char c = *p;
+
+		// The attr-char set of RFC 8187, which leaves nothing that
+		// could end the parameter or the header line.
+		if (!isalnum(c) && !strchr("!#$&+-.^_`|~", c)) {
+			html_raw(txt, p - txt);
+			htmlf("%%%02X", c);
+			txt = p + 1;
+		}
+		p++;
+	}
+	if (p != txt)
+		html(txt);
+}
+
 /*
  * A query string goes into a header the way it arrived, already encoded by
  * the client, except that a byte a header line cannot carry is percent-encoded
diff --git a/source/html.h b/source/html.hindex 4c16f85..1accb37 100644--- a/source/html.h+++ b/source/html.h@@ -93,6 +93,13 @@ extern void html_attr_url(const char *txt);  extern void html_url_arg(const char *txt); extern void html_header_arg_in_quotes(const char *txt);++/*+ * Percent-encode txt as the value of an RFC 8187 header parameter such as+ * filename*, leaving out the charset and language the value opens with.+ */+extern void html_header_ext_value(const char *txt);+ extern void html_header_query(const char *txt); extern void html_hidden(const char *name, const char *value); 
diff --git a/source/html.h b/source/html.h
index 4c16f85..1accb37 100644
--- a/source/html.h
+++ b/source/html.h
@@ -93,6 +93,13 @@ extern void html_attr_url(const char *txt);
 
 extern void html_url_arg(const char *txt);
 extern void html_header_arg_in_quotes(const char *txt);
+
+/*
+ * Percent-encode txt as the value of an RFC 8187 header parameter such as
+ * filename*, leaving out the charset and language the value opens with.
+ */
+extern void html_header_ext_value(const char *txt);
+
 extern void html_header_query(const char *txt);
 extern void html_hidden(const char *name, const char *value);
 
diff --git a/source/ui-shared.c b/source/ui-shared.cindex 9e3757d..d2eec25 100644--- a/source/ui-shared.c+++ b/source/ui-shared.c@@ -1385,6 +1385,30 @@ static int type_has_charset(const char *mimetype) 		ends_with(mimetype, "+xml"); } +/*+ * Whether a download name goes out a second time as RFC 6266's filename*,+ * which is so for a name past ASCII. That form carries UTF-8 alone, so a name+ * that is not valid UTF-8 keeps the plain filename by itself.+ */+static int wants_ext_filename(const char *name)+{+	const unsigned char *p = (const unsigned char *)name;+	size_t left = strlen(name);+	int past_ascii = 0;++	while (left) {+		size_t seq = *p < 0x80 ? 1 : cgit_utf8_seq_len(p, left);++		if (!seq)+			return 0;+		if (seq > 1)+			past_ascii = 1;+		p += seq;+		left -= seq;+	}+	return past_ascii;+}+ void cgit_print_http_headers(void) { 	ctx.page.headers_sent = 1;@@ -1408,7 +1432,14 @@ void cgit_print_http_headers(void) 	if (ctx.page.filename) { 		html("Content-Disposition: inline; filename=\""); 		html_header_arg_in_quotes(ctx.page.filename);-		html("\"\n");+		html("\"");+		// A client that knows filename* reads it in place of filename,+		// which stays for one that does not.+		if (wants_ext_filename(ctx.page.filename)) {+			html("; filename*=UTF-8''");+			html_header_ext_value(ctx.page.filename);+		}+		html("\n"); 	} 	// An untrusted page serves repository bytes verbatim, so the browser is 	// told not to guess a type of its own from them and not to load
diff --git a/source/ui-shared.c b/source/ui-shared.c
index 9e3757d..d2eec25 100644
--- a/source/ui-shared.c
+++ b/source/ui-shared.c
@@ -1385,6 +1385,30 @@ static int type_has_charset(const char *mimetype)
 		ends_with(mimetype, "+xml");
 }
 
+/*
+ * Whether a download name goes out a second time as RFC 6266's filename*,
+ * which is so for a name past ASCII. That form carries UTF-8 alone, so a name
+ * that is not valid UTF-8 keeps the plain filename by itself.
+ */
+static int wants_ext_filename(const char *name)
+{
+	const unsigned char *p = (const unsigned char *)name;
+	size_t left = strlen(name);
+	int past_ascii = 0;
+
+	while (left) {
+		size_t seq = *p < 0x80 ? 1 : cgit_utf8_seq_len(p, left);
+
+		if (!seq)
+			return 0;
+		if (seq > 1)
+			past_ascii = 1;
+		p += seq;
+		left -= seq;
+	}
+	return past_ascii;
+}
+
 void cgit_print_http_headers(void)
 {
 	ctx.page.headers_sent = 1;
@@ -1408,7 +1432,14 @@ void cgit_print_http_headers(void)
 	if (ctx.page.filename) {
 		html("Content-Disposition: inline; filename=\"");
 		html_header_arg_in_quotes(ctx.page.filename);
-		html("\"\n");
+		html("\"");
+		// A client that knows filename* reads it in place of filename,
+		// which stays for one that does not.
+		if (wants_ext_filename(ctx.page.filename)) {
+			html("; filename*=UTF-8''");
+			html_header_ext_value(ctx.page.filename);
+		}
+		html("\n");
 	}
 	// An untrusted page serves repository bytes verbatim, so the browser is
 	// told not to guess a type of its own from them and not to load
diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.shindex ded694d..0ada26d 100755--- a/tests/t0110-snapshot.sh+++ b/tests/t0110-snapshot.sh@@ -430,4 +430,18 @@ test_expect_success 'a signature past max-blob-size is refused' ' 	cgit_ok sigrc "url=signed/snapshot/signed-one.tar.gz.asc" >tmp ' +# A tag named in UTF-8 gives a snapshot name past ASCII, which is sent as it+# is in filename and percent-encoded in filename*.+test_expect_success 'a snapshot name in UTF-8 is also sent as filename*' '+	mkrepo repos/accent 1 &&+	tag=$(printf "caf\303\251") &&+	git -C repos/accent tag "$tag" &&+	cgitrc_repo accentrc accent snapshots=tar &&+	cgit_ok accentrc "url=accent/refs/tags" >tmp &&+	test_grep "<a href=./accent/snapshot/accent-caf%C3%A9.tar.>accent-$tag.tar</a>" tmp &&+	cgit_ok accentrc "url=accent/snapshot/accent-caf%C3%A9.tar" >tmp &&+	sed "/^$/q" tmp >headers &&+	test_grep "^Content-Disposition: inline; filename=.accent-$tag.tar.; filename\*=UTF-8..accent-caf%C3%A9.tar$" headers+'+ test_done
diff --git a/tests/t0110-snapshot.sh b/tests/t0110-snapshot.sh
index ded694d..0ada26d 100755
--- a/tests/t0110-snapshot.sh
+++ b/tests/t0110-snapshot.sh
@@ -430,4 +430,18 @@ test_expect_success 'a signature past max-blob-size is refused' '
 	cgit_ok sigrc "url=signed/snapshot/signed-one.tar.gz.asc" >tmp
 '
 
+# A tag named in UTF-8 gives a snapshot name past ASCII, which is sent as it
+# is in filename and percent-encoded in filename*.
+test_expect_success 'a snapshot name in UTF-8 is also sent as filename*' '
+	mkrepo repos/accent 1 &&
+	tag=$(printf "caf\303\251") &&
+	git -C repos/accent tag "$tag" &&
+	cgitrc_repo accentrc accent snapshots=tar &&
+	cgit_ok accentrc "url=accent/refs/tags" >tmp &&
+	test_grep "<a href=./accent/snapshot/accent-caf%C3%A9.tar.>accent-$tag.tar</a>" tmp &&
+	cgit_ok accentrc "url=accent/snapshot/accent-caf%C3%A9.tar" >tmp &&
+	sed "/^$/q" tmp >headers &&
+	test_grep "^Content-Disposition: inline; filename=.accent-$tag.tar.; filename\*=UTF-8..accent-caf%C3%A9.tar$" headers
+'
+
 test_done
diff --git a/tests/t0301-security.sh b/tests/t0301-security.shindex 6ea8d45..7f0bb59 100755--- a/tests/t0301-security.sh+++ b/tests/t0301-security.sh@@ -666,6 +666,26 @@ test_expect_success 'a requested download name cannot split the headers' ' 	test_grep ! "^X-Injected" headers ' +# A download name past ASCII is sent again as filename*, percent-encoded in+# UTF-8, which a client that knows the form reads in place of the plain one.+# A quote, a backslash and a control byte keep their escapes in the plain+# form and are percent-encoded in the other. A name that is not valid UTF-8+# cannot be given as UTF-8, so it keeps the plain form alone.+test_expect_success 'a download name past ASCII is also sent as filename*' '+	blob=$(git -C repos/mk rev-parse HEAD:file-1) &&+	cgit_ok mkrc "url=mk/blob/&id=$blob&path=%22caf%C3%A9%5C%0D%0AX-Injected:%201%01" >tmp &&+	sed -n "1,/^\$/p" tmp >headers &&+	test_grep ! "^X-Injected" headers &&+	grep "^Content-Disposition:" headers >actual &&+	printf "Content-Disposition: inline; filename=\042\134\042caf\303\251\134\134\134r\134nX-Injected: 1?\042; filename*=UTF-8\047\047%%22caf%%C3%%A9%%5C%%0D%%0AX-Injected%%3A%%201%%01\n" >expect &&+	test_cmp expect actual &&+	cgit_ok mkrc "url=mk/blob/&id=$blob&path=bad%FF" >tmp &&+	sed -n "1,/^\$/p" tmp >headers &&+	grep "^Content-Disposition:" headers >actual &&+	printf "Content-Disposition: inline; filename=\042bad\377\042\n" >expect &&+	test_cmp expect actual+'+ # The about page of a repository without a readme sends the visitor on to # the summary with the query string as it arrived, which a server hands over # undecoded, so a byte no header line may carry is encoded on the way out.@@ -712,8 +732,9 @@ test_expect_success 'a file name of stray bytes is linked percent-encoded' '  # A name in UTF-8 is the common case of the same. It goes through the index # as well, so the tree holds the composed form whatever a filesystem makes-# of the name, and each page shows it as it is, the download name included,-# and links it percent-encoded.+# of the name, and each page shows it as it is and links it percent-encoded.+# The download name is sent as it is in filename and percent-encoded in+# filename*. test_expect_success 'a UTF-8 file name is shown as it is and linked percent-encoded' ' 	mkrepo repos/utf8 1 && 	name=$(printf "caf\303\251.txt") &&@@ -738,7 +759,7 @@ test_expect_success 'a UTF-8 file name is shown as it is and linked percent-enco 	test_grep "<code>au revoir$" tmp && 	test_grep ! "href=.[^>]*$name" tmp && 	cgit_ok utf8rc "url=utf8/plain/$encoded" >tmp &&-	test_grep "^Content-Disposition: inline; filename=.$name.$" tmp &&+	test_grep "^Content-Disposition: inline; filename=.$name.; filename\*=UTF-8..$encoded$" tmp && 	strip_headers <tmp >body && 	echo "au revoir" >expect && 	test_cmp expect body &&
diff --git a/tests/t0301-security.sh b/tests/t0301-security.sh
index 6ea8d45..7f0bb59 100755
--- a/tests/t0301-security.sh
+++ b/tests/t0301-security.sh
@@ -666,6 +666,26 @@ test_expect_success 'a requested download name cannot split the headers' '
 	test_grep ! "^X-Injected" headers
 '
 
+# A download name past ASCII is sent again as filename*, percent-encoded in
+# UTF-8, which a client that knows the form reads in place of the plain one.
+# A quote, a backslash and a control byte keep their escapes in the plain
+# form and are percent-encoded in the other. A name that is not valid UTF-8
+# cannot be given as UTF-8, so it keeps the plain form alone.
+test_expect_success 'a download name past ASCII is also sent as filename*' '
+	blob=$(git -C repos/mk rev-parse HEAD:file-1) &&
+	cgit_ok mkrc "url=mk/blob/&id=$blob&path=%22caf%C3%A9%5C%0D%0AX-Injected:%201%01" >tmp &&
+	sed -n "1,/^\$/p" tmp >headers &&
+	test_grep ! "^X-Injected" headers &&
+	grep "^Content-Disposition:" headers >actual &&
+	printf "Content-Disposition: inline; filename=\042\134\042caf\303\251\134\134\134r\134nX-Injected: 1?\042; filename*=UTF-8\047\047%%22caf%%C3%%A9%%5C%%0D%%0AX-Injected%%3A%%201%%01\n" >expect &&
+	test_cmp expect actual &&
+	cgit_ok mkrc "url=mk/blob/&id=$blob&path=bad%FF" >tmp &&
+	sed -n "1,/^\$/p" tmp >headers &&
+	grep "^Content-Disposition:" headers >actual &&
+	printf "Content-Disposition: inline; filename=\042bad\377\042\n" >expect &&
+	test_cmp expect actual
+'
+
 # The about page of a repository without a readme sends the visitor on to
 # the summary with the query string as it arrived, which a server hands over
 # undecoded, so a byte no header line may carry is encoded on the way out.
@@ -712,8 +732,9 @@ test_expect_success 'a file name of stray bytes is linked percent-encoded' '
 
 # A name in UTF-8 is the common case of the same. It goes through the index
 # as well, so the tree holds the composed form whatever a filesystem makes
-# of the name, and each page shows it as it is, the download name included,
-# and links it percent-encoded.
+# of the name, and each page shows it as it is and links it percent-encoded.
+# The download name is sent as it is in filename and percent-encoded in
+# filename*.
 test_expect_success 'a UTF-8 file name is shown as it is and linked percent-encoded' '
 	mkrepo repos/utf8 1 &&
 	name=$(printf "caf\303\251.txt") &&
@@ -738,7 +759,7 @@ test_expect_success 'a UTF-8 file name is shown as it is and linked percent-enco
 	test_grep "<code>au revoir$" tmp &&
 	test_grep ! "href=.[^>]*$name" tmp &&
 	cgit_ok utf8rc "url=utf8/plain/$encoded" >tmp &&
-	test_grep "^Content-Disposition: inline; filename=.$name.$" tmp &&
+	test_grep "^Content-Disposition: inline; filename=.$name.; filename\*=UTF-8..$encoded$" tmp &&
 	strip_headers <tmp >body &&
 	echo "au revoir" >expect &&
 	test_cmp expect body &&