fix(core): escape backslashes in Content-Disposition quoted filenames

[dinwwwh]

The quoted-string escaper in generateContentDisposition escaped " but not \, so a filename ending in a backslash turned the closing quote into an escaped quote and let the rest of an attacker-controlled filename be smuggled into extra Content-Disposition parameters. Both characters are now escaped per the RFC 9110 §5.6.4 quoted-string rules, and getFilenameFromContentDisposition unescapes any quoted-pair so backslash filenames round-trip correctly.

Fixes

• filename="..." values are now always valid quoted-strings — a trailing \ or \"; injected=x payload can no longer break out of the quotes.
• Parsing now decodes \\ (and any other quoted-pair), so generate → parse round-trips filenames containing backslashes.

Impact

Low severity: CR/LF were already filtered and the disposition type is hardcoded, so this permitted parameter injection only — and in the reachable flow the attacker already controls the whole filename. Fixed as a correctness bug.

Testing

• New tests cover backslash escaping, the trailing-backslash edge, the injection payload, and parser round-trips.
• Core, peer, node, and fetch body/utils suites pass (127 tests); workspace type:check and ESLint clean.

[pkg-pr-new]

• @standardserver/hono-node-playground
• @standardserver/node-http-playground

@standardserver/bun

npm i https://pkg.pr.new/@standardserver/bun@47

@standardserver/core

npm i https://pkg.pr.new/@standardserver/core@47

@standardserver/deno

npm i https://pkg.pr.new/@standardserver/deno@47

@standardserver/fastify

npm i https://pkg.pr.new/@standardserver/fastify@47

@standardserver/fetch

npm i https://pkg.pr.new/@standardserver/fetch@47

@standardserver/node

npm i https://pkg.pr.new/@standardserver/node@47

@standardserver/peer

npm i https://pkg.pr.new/@standardserver/peer@47

@standardserver/shared

npm i https://pkg.pr.new/@standardserver/shared@47

commit: 2b4394d

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

---

_{Comparing claude/content-disposition-escaper-fix-4a3b08 (2b4394d) with main (fb412ca)}

Footnotes

1. 108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[Copilot]

Pull request overview

This PR hardens Content-Disposition filename handling by correctly escaping backslashes in generated quoted filenames and by unescaping any quoted-pair sequences when parsing filename="...", preventing quoted-string breakouts and enabling correct round-trips for backslash-containing filenames.

Changes:

• Escape both " and \ in generateContentDisposition() per quoted-string rules.
• Update getFilenameFromContentDisposition() to parse and decode quoted-pairs (e.g., \\ → \).
• Add tests for backslash escaping, trailing-backslash safety, injection payloads, and backslash round-trips.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
packages/core/src/utils.ts	Updates Content-Disposition generation/parsing to escape \ and decode quoted-pairs.
packages/core/src/utils.test.ts	Adds coverage for backslash-related edge cases and parsing round-trips.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.