From ded02a8857d2d092a490f5f394ebd4094023e9bf Mon Sep 17 00:00:00 2001
From: motoyasu-saburi <kumagoro_alice@yahoo.co.jp>
Date: Sat, 1 Apr 2023 12:25:32 +0900
Subject: [PATCH] fix lack of escaping of filename in Content-Disposition

---
 context.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/context.go b/context.go
index 5716318e..4d87c326 100644
--- a/context.go
+++ b/context.go
@@ -1056,7 +1056,7 @@ func (c *Context) FileFromFS(filepath string, fs http.FileSystem) {
 // On the client side, the file will typically be downloaded with the given filename
 func (c *Context) FileAttachment(filepath, filename string) {
 	if isASCII(filename) {
-		c.Writer.Header().Set("Content-Disposition", `attachment; filename="`+filename+`"`)
+		c.Writer.Header().Set("Content-Disposition", `attachment; filename="`+strings.Replace(filename, "\"", "\\\"", -1)+`"`)
 	} else {
 		c.Writer.Header().Set("Content-Disposition", `attachment; filename*=UTF-8''`+url.QueryEscape(filename))
 	}