Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading "The Tangled Web"(A book that I'm enjoying very much) and I have a doubt in the following excerpt taken from it :-

When Handling User-Controlled Filenames in Content-Disposition Headers
 If you do not need non-Latin characters: Strip or substitute any characters except for alpha- numerics, “.”, “-”, and “_”. To protect your users against potentially harmful or deceptive filenames, you may also want to confirm that at least the first character is alphanumeric and substitute all but the rightmost period with something else (e.g., an underscore).
Keep in mind that allowing quotes, semicolons, backslashes, and control characters (0x00–0x1F) will introduce vulnerabilities.
 If you need non-Latin names: You must use RFC 2047, RFC 2231, or URL-style percent encoding in a browser-dependent manner. Make sure to filter out control characters (0x00–0x1F) and escape any semicolons, backslashes, and quotes.
  • Which are the characters meant to be URL percent encoded?
  • By "escaping semicolons, backslashes, and quotes", is escaping using backslashes meant?
share|improve this question
2  
That is a great book! –  makerofthings7 Oct 30 '12 at 15:17

2 Answers 2

up vote 4 down vote accepted

Allowing user controlled input in the HTTP header is very dangerous. I would have a strict whitelist of possible values.

Also, escaping is not always done with a backslash. Backslashes sometimes applies to quoted data, but always. In this case an HTML entity or URL encode would be safe.

share|improve this answer

If you need non-Latin names: You must use RFC 2047, RFC 2231, or URL-style percent encoding in a browser-dependent manner. Make sure to filter out control characters (0x00–0x1F) and escape any semicolons, backslashes, and quotes.

Don't even go there. Hidden behind the words "browser-dependent" is a set of inconsistent and incomplete escaping rules that varies wildly across browsers. Sniffing the browser type and serving up a different encoding for different cases is not really feasible at all... even if you did so (and handled Vary/cache properly to match), there are characters that are impossible to encode for each of the browsers.

Which are the characters meant to be URL percent encoded?

On IE, ;, " and anything non-ASCII. On any other browser, percent encoding in Content-Disposition is not effective.

By "escaping semicolons, backslashes, and quotes", is escaping using backslashes meant?

Yes, but only Opera supports this properly IIRC.

Eventually the rules of RFC 6266 will fix this grisly mess, but support isn't there yet. If you want arbitrary Unicode characters in the download filename, the only reliable way of doing it is to put the fake filename in a trailing part of the URL path, UTF-8-URL-encoded (IRI-style) eg.:

http://www.example.com/download.cgi/h%c3%a9llo%20%e6%97%a5%e6%9c%ac.dat

results in download filename héllo 日本.dat.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.