asp.net - Downloading file with ";" or "#" in file name ruins filename

Question

I have a file named AttachmentDownload.aspx and inside Page_Load method have such code which offers to download file. All names work correctly in IE except names which include ";" or "#". They offer user to save the file under name "AttachmentDownload.aspx". Is there a workaround for this?

Here is an example:

var fileName = Server.UrlPathEncode (";%.txt");
Response.AddHeader("content-disposition", String.Format("attachment;filename="{0}"", fileName));
Response.WriteFile(path);
Response.End();

Answer 1

All names work correctly in IE except names which include ";" or "#".

I can't reproduce the problem with ‘#’ but ‘;’ certainly does break it. As will ‘"’ and ‘’ (which you can have in a filename on Unix and which will break your quoted-string).

The “correct” solution for including out-of-band characters in an RFC822-family parameterised header such as Content-Disposition is defined in RFC1521: strings that cannot be contained in a ‘token’ should be wrapped in a quoted-string, which RFC2822 defines as having the " and characters backslash-escaped, then surrounded in quotes.

RFC2231 then extends this with a very complicated way of including non-ASCII characters in header parameters, which in theory you would want to use to support Unicode characters.

In practice: HTTP is not really an RFC822-family specification, and none of this stuff works in regular browsers (except the backslash-escapes in Opera). There is no reliable way to get a Unicode Content-Disposition filename to the client, and your problem with ‘;’ is there not because of any escaping issue, but just because IE can't parse parameterised headers for toffee (it splits on the next semicolon in the string even if it's surrounded by quotes).

For reliable cross-browser filename-setting there are two approaches you can take in the real world:

1. Remove anything offensive from filenames before putting them in a Content-Disposition header. This includes leading/trailing spaces/dots, most other punctuation and anything non-ASCII.

2. Don't specify a filename in the Content-Disposition header at all, and let the browser work out what filename to use from the last part of the URL. To stop it choosing “AttachmentDownload.aspx”, you can put whatever you like as a trailing URL part, eg.:

   http://www.example.com/AttachmentDownload.aspx/Foo%23Bar

This requires you encode most punctuation using plain URL encoding and Unicode characters with UTF-8, but at least you can get the characters in. The above results in a file download prompt for ‘Foo;Bar’.

Note that even though you can encode Windows-unfriendly characters like ‘"’ in a URL path part like this, for downloaded files it is best not to, because IE will respond by trying to save the file using a ‘"’ in the filename, and will silently and mysteriously fail in response.