filtering content in Content disposition header

Question

I was reading "The Tangled Web"(A book that I'm enjoying very much) and I have a doubt in the following excerpt taken from it :-

When Handling User-Controlled Filenames in Content-Disposition Headers
 If you do not need non-Latin characters: Strip or substitute any characters except for alpha- numerics, “.”, “-”, and “_”. To protect your users against potentially harmful or deceptive filenames, you may also want to confirm that at least the first character is alphanumeric and substitute all but the rightmost period with something else (e.g., an underscore).
Keep in mind that allowing quotes, semicolons, backslashes, and control characters (0x00–0x1F) will introduce vulnerabilities.
 If you need non-Latin names: You must use RFC 2047, RFC 2231, or URL-style percent encoding in a browser-dependent manner. Make sure to filter out control characters (0x00–0x1F) and escape any semicolons, backslashes, and quotes.

• Which are the characters meant to be URL percent encoded?
• By "escaping semicolons, backslashes, and quotes", is escaping using backslashes meant?

Answer 1

Allowing user controlled input in the HTTP header is very dangerous. I would have a strict whitelist of possible values.

Also, escaping is not always done with a backslash. Backslashes sometimes applies to quoted data, but always. In this case an HTML entity or URL encode would be safe.

Answer 2

If you need non-Latin names: You must use RFC 2047, RFC 2231, or URL-style percent encoding in a browser-dependent manner. Make sure to filter out control characters (0x00–0x1F) and escape any semicolons, backslashes, and quotes.

Don't even go there. Hidden behind the words "browser-dependent" is a set of inconsistent and incomplete escaping rules that varies wildly across browsers. Sniffing the browser type and serving up a different encoding for different cases is not really feasible at all... even if you did so (and handled Vary/cache properly to match), there are characters that are impossible to encode for each of the browsers.

Which are the characters meant to be URL percent encoded?

On IE, ;, " and anything non-ASCII. On any other browser, percent encoding in Content-Disposition is not effective.

By "escaping semicolons, backslashes, and quotes", is escaping using backslashes meant?

Yes, but only Opera supports this properly IIRC.

Eventually the rules of RFC 6266 will fix this grisly mess, but support isn't there yet. If you want arbitrary Unicode characters in the download filename, the only reliable way of doing it is to put the fake filename in a trailing part of the URL path, UTF-8-URL-encoded (IRI-style) eg.:

http://www.example.com/download.cgi/h%c3%a9llo%20%e6%97%a5%e6%9c%ac.dat

results in download filename héllo 日本.dat.