Skip to content

Decode ISO-8859-1 filename* in Content-Disposition - #78

Merged
anmolkapil merged 1 commit into
anmolkapil:mainfrom
kevin9327:fix/latin1-filename-star
Oct 5, 2026
Merged

anmolkapil merged 1 commit into
anmolkapil:mainfrom
kevin9327:fix/latin1-filename-star

Conversation

@kevin9327

Copy link
Copy Markdown
Contributor

When a server sends an RFC 5987 filename* in ISO-8859-1, the downloaded file is named after the raw percent-escapes.

Content-Disposition: attachment; filename*=iso-8859-1'en'%A3%20rates.txt

Before: the file is saved as %A3%20rates.txt. After: it is saved as £ rates.txt.

parseContentDispositionFilename passes every filename* value to decodeURIComponent. That function only reads UTF-8, so a Latin-1 byte such as %A3 throws a URIError, and the catch returns the undecoded value. RFC 5987 requires recipients to support both UTF-8 and ISO-8859-1, and the header above is the RFC's own example. Servers that still default to Latin-1 send it this way.

Change

  • src/main/download/probe.ts: the regex now captures the charset. For iso-8859-1, each %XX is decoded as one Latin-1 character. UTF-8 and other charsets go through the same path as before.
  • e2e/download.spec.ts: new case in the file names @smoke table.

How I checked

  • The new e2e case fails on main (fileName is %A3%20rates.txt) and passes with the fix.
  • npm run lint, npm run typecheck, and npm run format:check pass.
  • npm run test:e2e:smoke: 90 passed, on Linux under xvfb.

@anmolkapil

Copy link
Copy Markdown
Owner

Thanks!

@anmolkapil
anmolkapil merged commit 4995e05 into anmolkapil:main Oct 5, 2026
@kevin9327

Copy link
Copy Markdown
Contributor Author

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants