Reduce ambiguity of file names with hex escape

HISTORY.md

@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Reduce ambiguity of file names with hex escape in buggy browsers
+
 0.1.2 / 2014-09-19
 ==================
 

index.js

@@ -28,6 +28,12 @@ var asciiStringRegExp = /^[\x00-\x7f]*$/
 
 var encodeUriAttrCharRegExp = /[\x00-\x20"'\(\)*,\/:;<=>?@\[\\\]\{\}\x7f]/g
 
+/**
+ * RegExp to match percent encoding escape.
+ */
+
+var hexEscapeRegExp = /%[0-9A-F]{2}/i
+
 /**
  * RegExp to match non-US-ASCII characters.
  */
@@ -68,7 +74,7 @@ function contentDisposition(filename) {
   // restrict to file base name
   var name = basename(filename)
 
-  if (asciiStringRegExp.test(name)) {
+  if (asciiStringRegExp.test(name) && !hexEscapeRegExp.test(name)) {
     // simple header
     // file name is always quoted and not a token for RFC 2616 compatibility
     return 'attachment; filename=' + qstring(name)

test/test.js

@@ -49,4 +49,14 @@ describe('contentDisposition(filename)', function () {
       assert.equal(contentDisposition('«\'*%()».pdf'), 'attachment; filename="?\'*%()?.pdf"; filename*=UTF-8\'\'%C2%AB%27%2A%25%28%29%C2%BB.pdf')
     })
   })
+
+  describe('when "filename" contains hex escape', function () {
+    it('should include filename* parameter', function () {
+      assert.equal(contentDisposition('the%20plans.pdf'), 'attachment; filename="the%20plans.pdf"; filename*=UTF-8\'\'the%2520plans.pdf')
+    })
+
+    it('should handle Unicode', function () {
+      assert.equal(contentDisposition('«%20».pdf'), 'attachment; filename="?%20?.pdf"; filename*=UTF-8\'\'%C2%AB%2520%C2%BB.pdf')
+    })
+  })
 })