From 80c391e18278fcb91189a664bb2b2ddaad7eb7a9 Mon Sep 17 00:00:00 2001
From: Peter Johnson <johnson.peter@gmail.com>
Date: Sun, 15 Dec 2024 12:28:08 -0800
Subject: [PATCH] [wpinet] WebServer: Unescape URI (#7552)

Also provide Content-Disposition filename header in response.

This fixes e.g. filenames with spaces in them.
---
 wpinet/src/main/native/cpp/WebServer.cpp | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/wpinet/src/main/native/cpp/WebServer.cpp b/wpinet/src/main/native/cpp/WebServer.cpp
index 3e00482b57..9efd76a190 100644
--- a/wpinet/src/main/native/cpp/WebServer.cpp
+++ b/wpinet/src/main/native/cpp/WebServer.cpp
@@ -15,11 +15,13 @@
 #include <fmt/format.h>
 #include <wpi/DenseMap.h>
 #include <wpi/MemoryBuffer.h>
+#include <wpi/SmallString.h>
 #include <wpi/Signal.h>
 #include <wpi/StringMap.h>
 #include <wpi/fs.h>
 #include <wpi/json.h>
 #include <wpi/print.h>
+#include <wpi/raw_ostream.h>
 
 #include "wpinet/EventLoopRunner.h"
 #include "wpinet/HttpServerConnection.h"
@@ -239,6 +241,14 @@ void MyHttpConnection::ProcessRequest() {
   }
   // fmt::print(stderr, "path: \"{}\"\n", path);
 
+  wpi::SmallString<128> pathBuf;
+  bool error;
+  path = UnescapeURI(path, pathBuf, &error);
+  if (error) {
+    SendError(400);
+    return;
+  }
+
   std::string_view query;
   if (url.HasQuery()) {
     query = url.GetQuery();
@@ -314,8 +324,13 @@ void MyHttpConnection::ProcessRequest() {
         SendResponse(200, "OK", "text/html", html);
       }
     } else {
+      wpi::SmallString<128> extraHeadersBuf;
+      wpi::raw_svector_ostream os{extraHeadersBuf};
+      os << "Content-Disposition: filename=\"";
+      os.write_escaped(fullpath.filename().string());
+      os << "\"\r\n";
       SendFileResponse(200, "OK", GetMimeType(wpi::rsplit(path, '.').second),
-                       fullpath);
+                       fullpath, os.str());
     }
   } else {
     SendError(404, "Resource not found");