diff --git a/axum-extra/src/response/attachment.rs b/axum-extra/src/response/attachment.rs index c1246f59..54c3d415 100644 --- a/axum-extra/src/response/attachment.rs +++ b/axum-extra/src/response/attachment.rs @@ -56,11 +56,12 @@ impl Attachment { /// /// This updates the `Content-Disposition` header to add a filename. pub fn filename>(mut self, value: H) -> Self { - self.filename = if let Ok(filename) = value.try_into() { - Some(filename) - } else { - error!("Attachment filename contains invalid characters"); - None + self.filename = match value.try_into() { + Ok(filename) if filename.to_str().is_ok() => Some(filename), + _ => { + error!("Attachment filename contains invalid characters"); + None + } }; self } @@ -128,6 +129,14 @@ mod tests { assert_eq!(value, "attachment; filename=\"report.pdf\""); } + #[test] + fn attachment_with_opaque_filename() { + let filename = HeaderValue::from_bytes(b"report\xff.pdf").unwrap(); + let attachment = Attachment::new("data").filename(filename).into_response(); + let value = attachment.headers().get(CONTENT_DISPOSITION).unwrap(); + assert_eq!(value, "attachment"); + } + #[test] fn attachment_filename_escapes_quotes() { // A filename containing a double quote should be escaped to prevent