Repository navigation
Conversation
formatContentDisposition built filename* with url.PathEscape, which leaves characters such as '=', ':', '@' and the "'" delimiter unencoded. An ext-value may only contain attr-chars, so for a name like "ü=1.txt" the header was invalid and mime.ParseMediaType rejected it. Percent-encode every byte outside the attr-char set instead.
acodercat
requested review from
Pangjiping,
hittyt and
ninan-nn
as code owners
October 31, 2026 04:52
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
github-actions
Bot
added
component/execd
size/S
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For file names that need encoding (non-ASCII,
"or\),formatContentDispositionbuildsfilename*=UTF-8''+url.PathEscape(name). The same helper serves both/files/downloadand the isolated session download.url.PathEscapeencodes for a URL path segment, so it keeps characters such as=,:,@,&,+,$and'. RFC 8187'sext-valueonly allowsattr-charunencoded.'in particular is the delimiter between the charset and language fields. For a file namedü=1.txt, execd sendsand Go's
mime.ParseMediaTyperejects it withmime: invalid media parameter. Strict clients fail to read the name the same way.Summary
encodeExtValue, which percent-encodes every byte outside the RFC 8187attr-charset, and use it instead ofurl.PathEscape.filenamefallback andfilename*still carry the same encoded value. Names that only needed%XXfor non-ASCII bytes, and spaces, encode exactly as before, so the existing expected values all still hold.Testing
Not run (explain why)
Unit tests
Integration tests
e2e / manual verification
New
TestFormatContentDispositionRoundTripschecks thatmime.ParseMediaTypeparses the header and returns the original name forü=1.txt,报告:v1@2.txt,测试 文件.txt,a"b.txtanda'b(1).txt. On current main the first two fail to parse.The existing
TestFormatContentDispositiontable passes unchanged.All execd packages pass (
GOOS=linux),golangci-lintis clean, and darwin and windows builds succeed.Breaking Changes
Checklist