httplib: cover filename metacharacter escaping in ServeSetHeaders (#330)

* httplib: cover filename metacharacter escaping in ServeSetHeaders

* tests: clarify filename escaping test comment

Author: pedrogaudencio

modules/httplib/serve_test.go

@@ -121,6 +121,13 @@ func TestServeSetHeadersContentDisposition(t *testing.T) {
 	ServeSetHeaders(w, &ServeHeaderOptions{Filename: "foo.zip", Disposition: "inline"})
 	assert.Equal(t, `inline; filename="foo.zip"; filename*=UTF-8''foo.zip`, w.Header().Get("Content-Disposition"))
 
+	// quotes and backslashes must be escaped in the quoted-string form and
+	// percent-encoded in the RFC 5987 parameter, so the filename cannot break
+	// out of the quoted-string and inject disposition parameters
+	w = httptest.NewRecorder()
+	ServeSetHeaders(w, &ServeHeaderOptions{Filename: `a"b\c.zip`})
+	assert.Equal(t, `attachment; filename="a\"b\\c.zip"; filename*=UTF-8''a%22b%5Cc.zip`, w.Header().Get("Content-Disposition"))
+
 	w = httptest.NewRecorder()
 	ServeSetHeaders(w, &ServeHeaderOptions{})
 	assert.Empty(t, w.Header().Get("Content-Disposition"))