From cfd5a2c05511aca00f444223b7ba20af416baec7 Mon Sep 17 00:00:00 2001 From: Yash Siwach Date: Thu, 13 Aug 2026 10:15:03 +0530 Subject: [PATCH] Ensure parsing/toString symmetry in ContentDisposition name Signed-off-by: Yash Siwach --- .../org/springframework/http/ContentDisposition.java | 4 ++-- .../springframework/http/ContentDispositionTests.java | 11 +++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/spring-web/src/main/java/org/springframework/http/ContentDisposition.java b/spring-web/src/main/java/org/springframework/http/ContentDisposition.java index 6e2e5f2eb1d4..7ba9a5a1d743 100644 --- a/spring-web/src/main/java/org/springframework/http/ContentDisposition.java +++ b/spring-web/src/main/java/org/springframework/http/ContentDisposition.java @@ -172,7 +172,7 @@ public String toString() { sb.append(this.type); } if (this.name != null) { - sb.append("; name=\"").append(this.name).append('\"'); + sb.append("; name=\"").append(encodeQuotedPairs(this.name)).append('\"'); } if (this.filename != null) { if (this.charset == null || StandardCharsets.US_ASCII.equals(this.charset)) { @@ -253,7 +253,7 @@ public static ContentDisposition parse(String contentDisposition) { part.substring(eqIndex + 2, part.length() - 1) : part.substring(eqIndex + 1)); if (attribute.equals("name") ) { - name = value; + name = (value.indexOf('\\') != -1 ? decodeQuotedPairs(value) : value); } else if (attribute.equals("filename*") ) { int idx1 = value.indexOf('\''); diff --git a/spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java b/spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java index 2928b8367633..ea86c2ee783b 100644 --- a/spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java +++ b/spring-web/src/test/java/org/springframework/http/ContentDispositionTests.java @@ -360,6 +360,17 @@ void formatWithEncodedFilenameUsingInvalidCharset() { .build() .toString()); } + + @Test + void formatAndParseWithNameWithQuotes() { + ContentDisposition cd = ContentDisposition.formData() + .name("foo\"bar\\baz") + .build(); + assertThat(cd.toString()).isEqualTo("form-data; name=\"foo\\\"bar\\\\baz\""); + + ContentDisposition parsed = ContentDisposition.parse("form-data; name=\"foo\\\"bar\\\\baz\""); + assertThat(parsed.getName()).isEqualTo("foo\"bar\\baz"); + } } }