Encode filenames to UTF-8 in Content-Disposition header. (#16556)

Change-Id: Ie2cf41f2176d05105663cdb84934379efa826f03

2 files changed, 20 insertions, 16 deletions

diff --git a/server/src/com/vaadin/server/DownloadStream.java b/server/src/com/vaadin/server/DownloadStream.java
index 681c438967..8b2b933bcc 100644
--- a/server/src/com/vaadin/server/DownloadStream.java
+++ b/server/src/com/vaadin/server/DownloadStream.java
@@ -20,6 +20,8 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.Serializable;
+import java.io.UnsupportedEncodingException;
+import java.net.URLEncoder;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Map;
@@ -280,16 +282,9 @@ public class DownloadStream implements Serializable {
                     }
                 }
 
-                // suggest local filename from DownloadStream if
-                // Content-Disposition
-                // not explicitly set
-                String contentDispositionValue = getParameter("Content-Disposition");
-                if (contentDispositionValue == null) {
-                    contentDispositionValue = "filename=\"" + getFileName()
-                            + "\"";
-                    response.setHeader("Content-Disposition",
-                            contentDispositionValue);
-                }
+                // Content-Disposition: attachment generally forces download
+                response.setHeader("Content-Disposition",
+                        getContentDispositionValue());
 
                 int bufferSize = getBufferSize();
                 if (bufferSize <= 0 || bufferSize > Constants.MAX_BUFFER_SIZE) {
@@ -317,6 +312,21 @@ public class DownloadStream implements Serializable {
         }
     }
 
+    private String getContentDispositionValue()
+            throws UnsupportedEncodingException {
+        String contentDispositionValue = getParameter("Content-Disposition");
+
+        if (contentDispositionValue == null) {
+            String encodedFilename = URLEncoder.encode(getFileName(), "utf-8");
+
+            contentDispositionValue = String.format(
+                    "attachment; filename=\"%s\"; filename*=utf-8''%s",
+                    encodedFilename, encodedFilename);
+        }
+
+        return contentDispositionValue;
+    }
+
     /**
      * Helper method that tries to close an output stream and ignores any
      * exceptions.
diff --git a/server/src/com/vaadin/server/FileDownloader.java b/server/src/com/vaadin/server/FileDownloader.java
index 42c2f76e1a..bea9922c50 100644
--- a/server/src/com/vaadin/server/FileDownloader.java
+++ b/server/src/com/vaadin/server/FileDownloader.java
@@ -141,12 +141,6 @@ public class FileDownloader extends AbstractExtension {
             }
             stream = ((ConnectorResource) resource).getStream();
 
-            if (stream.getParameter("Content-Disposition") == null) {
-                // Content-Disposition: attachment generally forces download
-                stream.setParameter("Content-Disposition",
-                        "attachment; filename=\"" + stream.getFileName() + "\"");
-            }
-
             // Content-Type to block eager browser plug-ins from hijacking
             // the file
             if (isOverrideContentType()) {