audunru / export-response / 26866364569

99%

master: 99%

push

github

fix: build Content-Disposition with HeaderUtils to prevent header injection (#107)

Replaced manual sprintf with Symfony HeaderUtils::makeDisposition, which
safely escapes filenames (quotes, CRLF) rather than interpolating them
raw into the header value. Str::ascii() derives an ASCII fallback
automatically when only a single non-ASCII filename is passed, preserving
full UTF-8 support via filename* without throwing.

The emitted header format changes for ASCII filenames from the redundant
  attachment; filename="x.csv"; filename*=utf-8''x.csv
to the RFC-6266-correct
  attachment; filename=x.csv

7 of 7 new or added lines in 1 file covered. (100.0%)

138 of 139 relevant lines covered (99.28%)

10.99 hits per line