ZCU-DATA/fix: escape double quotes in Content-Disposition header for allzip download#1267
Merged
milanmajchrak merged 3 commits intocustomer/zcu-datafrom Mar 13, 2026
Conversation
…dpoint The allzip endpoint was generating an invalid Content-Disposition header when the item name contained double quotes (e.g. manuscript titles with quoted terms). This caused ERR_RESPONSE_HEADERS_MULTIPLE_CONTENT_DISPOSITION in browsers. Added buildContentDisposition() method using RFC 5987 encoding: - filename param: ASCII fallback with escaped quotes and backslashes - filename*: UTF-8 percent-encoded for modern clients Added integration tests for: - Item names with embedded double quotes - Item names with non-ASCII characters (diacritics)
There was a problem hiding this comment.
Pull request overview
Fixes invalid Content-Disposition generation for the allzip download when item names contain special characters (notably double quotes and non-ASCII), by generating an RFC 5987-compatible header and adding integration coverage for these cases.
Changes:
- Add
buildContentDisposition()to generatefilename(ASCII fallback with escaping) +filename*(UTF-8 percent-encoded). - Update the allzip download endpoint to use the new Content-Disposition builder.
- Add integration tests covering item names with embedded double quotes and diacritics.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
dspace-server-webapp/src/main/java/org/dspace/app/rest/MetadataBitstreamController.java |
Uses a new helper to build a safe RFC 5987 Content-Disposition header for allzip downloads. |
dspace-server-webapp/src/test/java/org/dspace/app/rest/MetadataBitstreamControllerIT.java |
Adds integration tests asserting correct Content-Disposition formatting for quoted and non-ASCII item names. |
You can also share your feedback on Copilot code review. Take the survey.
dspace-server-webapp/src/main/java/org/dspace/app/rest/MetadataBitstreamController.java
Show resolved
Hide resolved
dspace-server-webapp/src/main/java/org/dspace/app/rest/MetadataBitstreamController.java
Show resolved
Hide resolved
dspace-server-webapp/src/test/java/org/dspace/app/rest/MetadataBitstreamControllerIT.java
Outdated
Show resolved
Hide resolved
…dpoint The allzip endpoint was generating an invalid Content-Disposition header when the item name contained double quotes (e.g. manuscript titles with quoted terms). This caused ERR_RESPONSE_HEADERS_MULTIPLE_CONTENT_DISPOSITION in browsers. Added buildContentDisposition() method using RFC 5987 encoding: - filename param: ASCII fallback with escaped quotes and backslashes - filename*: UTF-8 percent-encoded for modern clients Added integration tests for: - Item names with embedded double quotes - Item names with non-ASCII characters (diacritics)
vidiecan
approved these changes
Mar 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem description
The allzip endpoint was generating an invalid Content-Disposition header when the item name contained double quotes (e.g. manuscript titles with quoted terms). This caused ERR_RESPONSE_HEADERS_MULTIPLE_CONTENT_DISPOSITION in browsers.
Added buildContentDisposition() method using RFC 5987 encoding:
Added integration tests for:
Manual Testing (if applicable)
Copilot review