2030811 - browser.downloads.download() rejects filenames containing U+00A0 (NBSP) with "filename must not contain illegal characters"

Status: RESOLVED DUPLICATE of bug 1791530

(WebExtensions :: Untriaged, enhancement)

Description

[Aleksandr Meshcheriakov]

Attachment: Minimal WebExtension repro: Firefox MV2 build (bugzilla-extension/) and Chromium MV3 build (bugzilla-extension-chromium/) — click toolbar icon, check console for OK/FAIL per codepoint

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:149.0) Gecko/20100101 Firefox/149.0

Steps to reproduce:

Minimal WebExtension repro (attached as downloads-nbsp-repro.zip, contains Firefox MV2 and Chromium MV3 builds):

1. Load the Firefox build (bugzilla-extension/) as a temporary add-on at about:debugging#/runtime/this-firefox.
2. Click the toolbar icon. The extension calls browser.downloads.download() with 10 different filenames, each containing a different Unicode codepoint, and logs OK / FAIL for each.
3. Open the extension's background console (Inspect button on about:debugging) to see the results.
4. Repeat with the Chromium MV3 build (bugzilla-extension-chromium/) on Chrome or Brave via chrome://extensions → Developer mode → Load unpacked.

The test filenames are all repro/foo{CHAR}bar.txt where {CHAR} is one of: ASCII space (control), NBSP U+00A0, narrow NBSP U+202F, soft hyphen U+00AD, ZWSP U+200B, BOM U+FEFF, word joiner U+2060, Cyrillic (control), em-dash U+2014 (control), fullwidth colon U+FF1A (control).

Tested on Firefox 149.0.2 (Linux x86_64) and Brave 1.88.138 (Official Build) (64-bit) /
Chromium: 146.0.7680.178 (Linux x86_64).

Actual results:

Firefox rejects 6 out of 10 filenames with "filename must not contain illegal characters":

Codepoint	Firefox	Chromium
ASCII space (control)	OK	OK
U+00A0 NBSP	FAIL	OK
U+202F narrow NBSP	FAIL	OK
U+00AD soft hyphen	FAIL	FAIL
U+200B ZWSP	FAIL	FAIL
U+FEFF BOM	FAIL	FAIL
U+2060 word joiner	FAIL	FAIL
Cyrillic (control)	OK	OK
U+2014 em-dash (ctrl)	OK	OK
U+FF1A fullwidth colon	OK	OK

4 of the 6 rejections (U+00AD, U+200B, U+FEFF, U+2060) match Chromium — both browsers agree these are unwanted in filenames.

U+00A0 (NBSP) and U+202F (narrow NBSP) are rejected only by Firefox. Chromium accepts both and writes them to disk as-is. All characters are valid on every modern filesystem (ext4, NTFS, APFS).

Expected results:

downloads.download() should accept U+00A0 and U+202F in filenames, matching Chromium behavior.

NBSP routinely appears in document.title on well-typeset pages — Russian, French, Polish, and Czech typography all use NBSP after one-letter prepositions (e.g. "Pies w\u00A0łóżku"). Extensions that derive filenames from page titles (SingleFile, Save Page WE, etc.) are forced to implement retry/sanitization logic specifically for Firefox, and the overly broad error message "filename must not contain illegal characters" gives no indication which character is the problem.

Alternatively, if the rejection is intentional, silently replacing NBSP/narrow NBSP with a regular space (instead of throwing) would let the download proceed without breaking extension retry logic.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.