[FIX] : and / are not safe in content-attachment filename

Browsers accept it as they are wont to do, but the Content-Disposition
lib (introduced in 35d452cffbb1554c70f0acba85dfc4ef472f544c) does
not. Simply don't mark them as safe when %-escaping the filename so
they do get %-escaped properly.

RFC5987 states

ext-parameter = parmname "*" LWSP "=" LWSP ext-value
ext-value     = charset  "'" [ language ] "'" value-chars
value-chars   = *( pct-encoded / attr-char )
attr-char     = ALPHA / DIGIT
              / "!" / "#" / "$" / "&" / "+" / "-" / "."
              / "^" / "_" / "`" / "|" / "~"
              ; token except ( "*" / "'" / "%" )

Neither : nor / are in attr-char. This is further confirmed by
checking out RFC2616:

CTL            = <any US-ASCII control character (octets 0 - 31) and DEL (127)>
token          = 1*<any CHAR except CTLs or separators>
separators     = "(" | ")" | "<" | ">" | "@"
               | "," | ";" | ":" | "\" | <">
               | "/" | "[" | "]" | "?" | "="
               | "{" | "}" | SP | HT

Here we can see "/" and ":" are both in "separators", which are
specifically *not* in token. attr-char restricts token further, so an
invalid token char can't be a valid attr-char.

0 files changed, 0 insertions, 0 deletions