# HG changeset patch
# User Sebastien Jodogne <s.jodogne@gmail.com>
# Date 1774423613 -3600
# Node ID eeeca0b5fab60dd38bfe4befdbb69f7c68263f00
# Parent  91d41f1b3b73040ff3c689579a37b930e291a600
sanitize "Content-Disposition" in HttpOutput::AnswerWithoutBuffering()

diff -r 91d41f1b3b73 -r eeeca0b5fab6 NEWS
--- a/NEWS	Mon Mar 23 08:08:49 2026 +0100
+++ b/NEWS	Wed Mar 25 08:26:53 2026 +0100
@@ -67,6 +67,7 @@
   - Fix possible memory exhaustion via very large "Content-Length"
   - Fix possible memory exhaustion via forged ZIP metadata
   - Fix possible memory exhaustion via forged gzip metadata
+  - Sanitize HTTP header "Content-Disposition" when creating ZIP archives
 * Upgraded dependencies for static builds:
   - boost 1.89.0
   - dcmtk 3.7.0
diff -r 91d41f1b3b73 -r eeeca0b5fab6 OrthancFramework/Sources/HttpServer/HttpOutput.cpp
--- a/OrthancFramework/Sources/HttpServer/HttpOutput.cpp	Mon Mar 23 08:08:49 2026 +0100
+++ b/OrthancFramework/Sources/HttpServer/HttpOutput.cpp	Wed Mar 25 08:26:53 2026 +0100
@@ -981,7 +981,7 @@
     std::string filename;
     if (stream.HasContentFilename(filename))
     {
-      stateMachine_.AddHeader("Content-Disposition", "filename=\"" + std::string(filename) + "\"");
+      stateMachine_.SetContentFilename(filename.c_str());
     }
 
     stateMachine_.StartStream(contentType);