584418 - quoted-string content-disposition filename encoded using RFC 2231 doesn't strip the quotes from the value

Status: RESOLVED WONTFIX

(Core :: Networking, defect)

Description

[Muhammad Najem]

User-Agent:       Mozilla/5.0 (Windows; Windows NT 6.1; rv:2.0b2) Gecko/20100720 Firefox/4.0b2
Build Identifier: Mozilla/5.0 (Windows; Windows NT 6.1; rv:2.0b2) Gecko/20100720 Firefox/4.0b2

 Firefox 4 beta 2 ignores the following redirecting link resulting in an unexpected result for the user :

the redirecting link is : http://www.timacheson.com/SkyDrive/DirectLinkRedirect?pageUrl= "

Please visit the following link with Firefox Stable & Firefox Beta to figure out the bug :

http://www.timacheson.com/SkyDrive/DirectLinkRedirect?pageUrl=http://cid-ae10be33b50b89e7.office.live.com/self.aspx/.Public/Why%20Muslims%20Love%20the%20Month%20of%20Ramadan.pdf 

Reproducible: Always

Steps to Reproduce:
1. Open the link of the post
2.Click on the download link 
3. 
Actual Results:  
you'll get two "_" marks at the beginning and the end of the file name and extensions resutling in a broken file with a wrong extension 

Expected Results:  
it should give me a download link with a proper extension without "_" mark at the end .

Comment 1

[Ashley Bischoff (blog at handcoding.com)]

Dupe of bug 584678?

Comment 2

[Boris Zbarsky [:bzbarsky]]

No, not at all.  Bug 584678 is about a _compile_ error in a build that's newer than beta 2.

This bug has nothing to do with redirects, and everything to do with this header the server sends:

Content-Disposition: attachment; filename*=UTF-8''"Why%20Muslims%20Love%20the%20Month%20of%20Ramadan.pdf"

for the actual URL involved, which is http://public.blu.livefilestore.com/y1pedrwDaQ2cDOWPG6cI1IGdGknjycoUXcvXE25pz5MhIn3ZpWBjkImsChNe__bFrfVwMf0oupEb8jw6o_nnmLR0g/Why%20Muslims%20Love%20the%20Month%20of%20Ramadan.pdf?xdownload&psid=1

Per spec, I think our behavior is correct, but it might be worth doing quoted-string detection after doing RFC 2231 encoding conversion...

Jason, can you double-check my spec-lawyering here?

Comment 3

[Boris Zbarsky [:bzbarsky]]

And to be clear, the HTTP RFC says that the filename is either a quoted-string or a single token.  The RFC 2231 encoded filename is a single token as far as HTTP is concerned, and RFC 2231 itself says nothing about quotes being OK to remove (because things are escaped through other means in RFC 2231).  So technically, that server is saying the filename is "Why Muslims Love the Month of Ramadan.pdf" including the '"' characters.

Comment 4

[Julian Reschke]

(In reply to comment #3)
> And to be clear, the HTTP RFC says that the filename is either a quoted-string
> or a single token.  The RFC 2231 encoded filename is a single token as far as
> HTTP is concerned, and RFC 2231 itself says nothing about quotes being OK to
> remove (because things are escaped through other means in RFC 2231).  So
> technically, that server is saying the filename is "Why Muslims Love the Month
> of Ramadan.pdf" including the '"' characters.

Agreed. Unless this is really widespread I'd recommend not to add any workarounds for broken content.