3 files changed, 59 insertions, 1 deletion

diff --git a/source/html.c b/source/html.cindex ce9344d..00eb7c6 100644--- a/source/html.c+++ b/source/html.c@@ -471,6 +471,26 @@ void html_header_arg_in_quotes(const char *txt) 		html(txt); } +void html_header_ext_value(const char *txt)+{+	const char *p = txt;++	while (p && *p) {+		unsigned char c = *p;++		// The attr-char set of RFC 8187, which leaves nothing that+		// could end the parameter or the header line.+		if (!isalnum(c) && !strchr("!#$&+-.^_`|~", c)) {+			html_raw(txt, p - txt);+			htmlf("%%%02X", c);+			txt = p + 1;+		}+		p++;+	}+	if (p != txt)+		html(txt);+}+ /*  * A query string goes into a header the way it arrived, already encoded by  * the client, except that a byte a header line cannot carry is percent-encoded
diff --git a/source/html.c b/source/html.c
index ce9344d..00eb7c6 100644
--- a/source/html.c
+++ b/source/html.c
@@ -471,6 +471,26 @@ void html_header_arg_in_quotes(const char *txt)
 		html(txt);
 }
 
+void html_header_ext_value(const char *txt)
+{
+	const char *p = txt;
+
+	while (p && *p) {
+		unsigned char c = *p;
+
+		// The attr-char set of RFC 8187, which leaves nothing that
+		// could end the parameter or the header line.
+		if (!isalnum(c) && !strchr("!#$&+-.^_`|~", c)) {
+			html_raw(txt, p - txt);
+			htmlf("%%%02X", c);
+			txt = p + 1;
+		}
+		p++;
+	}
+	if (p != txt)
+		html(txt);
+}
+
 /*
  * A query string goes into a header the way it arrived, already encoded by
  * the client, except that a byte a header line cannot carry is percent-encoded
diff --git a/source/html.h b/source/html.hindex 4c16f85..1accb37 100644--- a/source/html.h+++ b/source/html.h@@ -93,6 +93,13 @@ extern void html_attr_url(const char *txt);  extern void html_url_arg(const char *txt); extern void html_header_arg_in_quotes(const char *txt);++/*+ * Percent-encode txt as the value of an RFC 8187 header parameter such as+ * filename*, leaving out the charset and language the value opens with.+ */+extern void html_header_ext_value(const char *txt);+ extern void html_header_query(const char *txt); extern void html_hidden(const char *name, const char *value); 
diff --git a/source/html.h b/source/html.h
index 4c16f85..1accb37 100644
--- a/source/html.h
+++ b/source/html.h
@@ -93,6 +93,13 @@ extern void html_attr_url(const char *txt);
 
 extern void html_url_arg(const char *txt);
 extern void html_header_arg_in_quotes(const char *txt);
+
+/*
+ * Percent-encode txt as the value of an RFC 8187 header parameter such as
+ * filename*, leaving out the charset and language the value opens with.
+ */
+extern void html_header_ext_value(const char *txt);
+
 extern void html_header_query(const char *txt);
 extern void html_hidden(const char *name, const char *value);
 
diff --git a/source/ui-shared.c b/source/ui-shared.cindex 9e3757d..d2eec25 100644--- a/source/ui-shared.c+++ b/source/ui-shared.c@@ -1385,6 +1385,30 @@ static int type_has_charset(const char *mimetype) 		ends_with(mimetype, "+xml"); } +/*+ * Whether a download name goes out a second time as RFC 6266's filename*,+ * which is so for a name past ASCII. That form carries UTF-8 alone, so a name+ * that is not valid UTF-8 keeps the plain filename by itself.+ */+static int wants_ext_filename(const char *name)+{+	const unsigned char *p = (const unsigned char *)name;+	size_t left = strlen(name);+	int past_ascii = 0;++	while (left) {+		size_t seq = *p < 0x80 ? 1 : cgit_utf8_seq_len(p, left);++		if (!seq)+			return 0;+		if (seq > 1)+			past_ascii = 1;+		p += seq;+		left -= seq;+	}+	return past_ascii;+}+ void cgit_print_http_headers(void) { 	ctx.page.headers_sent = 1;@@ -1408,7 +1432,14 @@ void cgit_print_http_headers(void) 	if (ctx.page.filename) { 		html("Content-Disposition: inline; filename=\""); 		html_header_arg_in_quotes(ctx.page.filename);-		html("\"\n");+		html("\"");+		// A client that knows filename* reads it in place of filename,+		// which stays for one that does not.+		if (wants_ext_filename(ctx.page.filename)) {+			html("; filename*=UTF-8''");+			html_header_ext_value(ctx.page.filename);+		}+		html("\n"); 	} 	// An untrusted page serves repository bytes verbatim, so the browser is 	// told not to guess a type of its own from them and not to load
diff --git a/source/ui-shared.c b/source/ui-shared.c
index 9e3757d..d2eec25 100644
--- a/source/ui-shared.c
+++ b/source/ui-shared.c
@@ -1385,6 +1385,30 @@ static int type_has_charset(const char *mimetype)
 		ends_with(mimetype, "+xml");
 }
 
+/*
+ * Whether a download name goes out a second time as RFC 6266's filename*,
+ * which is so for a name past ASCII. That form carries UTF-8 alone, so a name
+ * that is not valid UTF-8 keeps the plain filename by itself.
+ */
+static int wants_ext_filename(const char *name)
+{
+	const unsigned char *p = (const unsigned char *)name;
+	size_t left = strlen(name);
+	int past_ascii = 0;
+
+	while (left) {
+		size_t seq = *p < 0x80 ? 1 : cgit_utf8_seq_len(p, left);
+
+		if (!seq)
+			return 0;
+		if (seq > 1)
+			past_ascii = 1;
+		p += seq;
+		left -= seq;
+	}
+	return past_ascii;
+}
+
 void cgit_print_http_headers(void)
 {
 	ctx.page.headers_sent = 1;
@@ -1408,7 +1432,14 @@ void cgit_print_http_headers(void)
 	if (ctx.page.filename) {
 		html("Content-Disposition: inline; filename=\"");
 		html_header_arg_in_quotes(ctx.page.filename);
-		html("\"\n");
+		html("\"");
+		// A client that knows filename* reads it in place of filename,
+		// which stays for one that does not.
+		if (wants_ext_filename(ctx.page.filename)) {
+			html("; filename*=UTF-8''");
+			html_header_ext_value(ctx.page.filename);
+		}
+		html("\n");
 	}
 	// An untrusted page serves repository bytes verbatim, so the browser is
 	// told not to guess a type of its own from them and not to load