2 files changed, 18 insertions, 0 deletions
diff --git a/source/html.c b/source/html.c
index b6e62a6..d1e28f8 100644
--- a/source/html.c
+++ b/source/html.c
@@ -367,6 +367,10 @@ void html_header_arg_in_quotes(const char *txt)
 			esc = "\\n";
 		else if (c == '"')
 			esc = "\\\"";
+		// A header line carries no other control byte either, and a web
+		// server refuses the whole response over one.
+		else if (c < 0x20 || c == 0x7f)
+			esc = "?";
 		if (esc) {
 			html_raw(txt, p - txt);
 			html(esc);
diff --git a/tests/t0105-plain.sh b/tests/t0105-plain.sh
index 2e5513f..4615dc5 100755
--- a/tests/t0105-plain.sh
+++ b/tests/t0105-plain.sh
@@ -96,4 +96,18 @@ test_expect_success 'plain answers once for duplicate tree entries' '
 	grep "^Content-Type: image/png" tmp
 '
 
+# A header line cannot carry a control byte, and a web server refuses the
+# whole response over one, so a file name holding one is sent with a stand-in.
+test_expect_success 'a control character in a file name stays out of the headers' '
+	(
+		cd repos/dup &&
+		blob=$(printf x | git hash-object -w --stdin) &&
+		top=$(printf "100644 blob %s\\tctl\\001name.txt\\n" $blob | git mktree) &&
+		c=$(echo ctl | git commit-tree $top) &&
+		git update-ref refs/heads/ctl $c
+	) &&
+	CGIT_CONFIG="$PWD/duprc" QUERY_STRING="url=dup/plain/ctl%01name.txt&h=ctl" cgit >tmp &&
+	grep "^Content-Disposition: inline; filename=.ctl?name.txt.$" tmp
+'
+
 test_done