프리이미지
사이트 내 전체검색

Handling of Content-Disposition header does not conform to standard (f…

페이지 정보

작성일12-01-11 17:08

본문

When the result of an http request to a webserver is a file download and your server responds with the following headers:

Content-Disposition: attachment; filename=arple.apk
Content-Type: application/vnd.android.package-archive

the file is saved incorrectly as "download.apk".

If the Content-Disposition header has the filename as a quoted-string, like this:

Content-Disposition: attachment; filename="arple.apk"

then the file is saved correctly as "arple.apk".

This violates the relevant standards.

RFC 2183 which documents the "Content-Disposition header" says:
<snip>
   filename-parm := "filename" "=" value
<snip>
NOTE ON PARAMETER VALUE LENGTHS: A short (length <= 78 characters)
   parameter value containing only non-`tspecials' characters SHOULD be
   represented as a single `token'.  A short parameter value containing
   only ASCII characters, but including `tspecials' characters, SHOULD
   be represented as `quoted-string'.  Parameter values longer than 78
   characters, or which contain non-ASCII characters, MUST be encoded as
   specified in [RFC 2184].

   `Extension-token', `parameter', `tspecials' and `value' are defined
   according to [RFC 2045] (which references [RFC 822] in the definition
   of some of these tokens).  `quoted-string' and `DIGIT' are defined in
   [RFC 822].

The filename "arple.apk" is less than 78 characters in length and does NOT contain any "tspecials" as defined in RFC 2045 and RFC 822 and therefore, according to the specification, SHOULD be represented as a single `token'.

However, the current Android implementation requires that the filename be represented as `quoted-string'.

I haven't done extensive testing, but as far as I know this is a problem with all Android devices starting with G1. We've verified this on HTC Desire with Android 2.1.

Comment 1 by jpsyjo...@gmail.comApr 19, 2011
Same problem on Motorola Defy with Android 2.1.
Small correction to above description:
> ...the file is saved incorrectly as "download.apk".
Correct:
...the file is saved incorrectly using the filename part of the serving URL on the webserver (e.g. download.php).

Comment 2 by julian.r...@gmail.comDec 20, 2011
a) You are reading more into the specs as you should; just because the filename *can* be represented as token doesn't mean it has to.

b) As a matter if fact, RFC 2616 used to define C-D only with quoted-string; see <http://greenbytes.de/tech/webdav/rfc2616.html#rfc.section.19.5.1>

c) In the meantime, the applicable spec is RFC 6266 (<http://greenbytes.de/tech/webdav/rfc6266.html>) which indeed allows both token and quoted-string (so the Android browser should support that), but also mandates support for RFC 5987 (which you'll absolutely need for non-ASCII characters in filenames).
추천 0