Page MenuHomePhabricator

Exported file response 'content-disposition' header doesn't quote filename
Closed, InvalidPublic

Description

According to Mozilla, in the content-disposition response header,

The string following filename should always be put into quotes; but, for compatibility reasons, many browsers try to parse unquoted names that contain spaces. -- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition

However the export links are currently giving me unquoted filenames:

https://wsexport.wmflabs.org/?format=epub-3&lang=en&page=On_Faraday%27s_Lines_of_Force

content-disposition: attachment; filename=On_Faraday's_Lines_of_Force.epub

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Inductiveload renamed this task from Exported file request 'content-disposition' header doesn't quote filename to Exported file response 'content-disposition' header doesn't quote filename.Jan 22 2021, 9:13 PM
Inductiveload updated the task description. (Show Details)

This header is constructed by Symfony (the framework used by this tool). This issue was reported a couple of years ago, and the response was that the unquoted form is correct.

Are you seeing an error with a particular browser?

@Samwilson I'm not seeing any error.

I was/am trying to pull the filename out of that header and found that it wasn't quoted, which is in opposition to what MDN says. If it's "not a bug" then I defer to the Symfony devs. Thanks for the reply.

Yeah, I agree with you in that it seems slightly odd, but if Symfony devs are happy then I think it's fine.

What are you trying to do? It seems possibly odd to read the filename out when to get the request you must be submitting what is more or less that same filename (with subpage slashes replaced). We might be able to do something else to help you.

The use case is a piece of extreme laziness on my part where I want to drag the "Download EPUB" link into a program with XDND to download it and display it (thus avoiding oh-so-arduously having to download it, save it, then drag the downloaded file). This means I only have the URL and whatever headers the response comes with to work with.

However, the idea was not to limit it to understanding ws-export links like https://wsexport.wmflabs.org/?format=epub-3&lang=en&page=Page_title and allow it to more universally extract the filename from things like content-disposition and then fall back on the URL.

Which then made me look closer at the content-disposition field because parsing that is non-trivial.

I guess the fix is probably be on the side of the XDND software, then. It should be handling the unquoted values and if it's not then that's a bug.

I'd say we could fix it on the wsexport side, but it does sound like it's obeying the rules, and as we're not constructing that header ourselves we'd have to override some parts that are handled for us. Better to not, if we can avoid it.