From 6a45d8c7e9f66d04cf4916264da135def5c0549d Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 19:31:51 -1000
Subject: Add filename* for a download name past ASCII
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The plain, snapshot and blob pages sent a name such as café.txt raw in
filename, which a client may read as ISO-8859-1. RFC 6266 has such a
name sent again as filename*, percent-encoded in UTF-8, for a client
that knows the form, with filename first for one that does not. The
extended form carries UTF-8 alone, so a name that is not valid UTF-8
keeps the plain filename by itself.
---
 source/html.c      | 20 ++++++++++++++++++++
 source/html.h      |  7 +++++++
 source/ui-shared.c | 33 ++++++++++++++++++++++++++++++++-
 3 files changed, 59 insertions(+), 1 deletion(-)

(limited to 'source')

diff --git a/source/html.c b/source/html.c
index ce9344d..00eb7c6 100644
--- a/source/html.c
+++ b/source/html.c
@@ -471,6 +471,26 @@ void html_header_arg_in_quotes(const char *txt)
 		html(txt);
 }
 
+void html_header_ext_value(const char *txt)
+{
+	const char *p = txt;
+
+	while (p && *p) {
+		unsigned char c = *p;
+
+		// The attr-char set of RFC 8187, which leaves nothing that
+		// could end the parameter or the header line.
+		if (!isalnum(c) && !strchr("!#$&+-.^_`|~", c)) {
+			html_raw(txt, p - txt);
+			htmlf("%%%02X", c);
+			txt = p + 1;
+		}
+		p++;
+	}
+	if (p != txt)
+		html(txt);
+}
+
 /*
  * A query string goes into a header the way it arrived, already encoded by
  * the client, except that a byte a header line cannot carry is percent-encoded
diff --git a/source/html.h b/source/html.h
index 4c16f85..1accb37 100644
--- a/source/html.h
+++ b/source/html.h
@@ -93,6 +93,13 @@ extern void html_attr_url(const char *txt);
 
 extern void html_url_arg(const char *txt);
 extern void html_header_arg_in_quotes(const char *txt);
+
+/*
+ * Percent-encode txt as the value of an RFC 8187 header parameter such as
+ * filename*, leaving out the charset and language the value opens with.
+ */
+extern void html_header_ext_value(const char *txt);
+
 extern void html_header_query(const char *txt);
 extern void html_hidden(const char *name, const char *value);
 
diff --git a/source/ui-shared.c b/source/ui-shared.c
index 9e3757d..d2eec25 100644
--- a/source/ui-shared.c
+++ b/source/ui-shared.c
@@ -1385,6 +1385,30 @@ static int type_has_charset(const char *mimetype)
 		ends_with(mimetype, "+xml");
 }
 
+/*
+ * Whether a download name goes out a second time as RFC 6266's filename*,
+ * which is so for a name past ASCII. That form carries UTF-8 alone, so a name
+ * that is not valid UTF-8 keeps the plain filename by itself.
+ */
+static int wants_ext_filename(const char *name)
+{
+	const unsigned char *p = (const unsigned char *)name;
+	size_t left = strlen(name);
+	int past_ascii = 0;
+
+	while (left) {
+		size_t seq = *p < 0x80 ? 1 : cgit_utf8_seq_len(p, left);
+
+		if (!seq)
+			return 0;
+		if (seq > 1)
+			past_ascii = 1;
+		p += seq;
+		left -= seq;
+	}
+	return past_ascii;
+}
+
 void cgit_print_http_headers(void)
 {
 	ctx.page.headers_sent = 1;
@@ -1408,7 +1432,14 @@ void cgit_print_http_headers(void)
 	if (ctx.page.filename) {
 		html("Content-Disposition: inline; filename=\"");
 		html_header_arg_in_quotes(ctx.page.filename);
-		html("\"\n");
+		html("\"");
+		// A client that knows filename* reads it in place of filename,
+		// which stays for one that does not.
+		if (wants_ext_filename(ctx.page.filename)) {
+			html("; filename*=UTF-8''");
+			html_header_ext_value(ctx.page.filename);
+		}
+		html("\n");
 	}
 	// An untrusted page serves repository bytes verbatim, so the browser is
 	// told not to guess a type of its own from them and not to load
-- 
cgit 2.12.1