Fix Content-Disposition header injection in GetObject

[G4brym]

Summary

• Fixes an unsanitized filename in the Content-Disposition header in packages/worker/src/modules/buckets/getObject.ts
• Filenames containing double quotes (e.g., my "file".pdf) could produce a malformed header like filename="my "file".pdf", breaking downloads or enabling header injection
• Adds an ASCII-safe filename parameter (non-ASCII chars replaced with _, double quotes replaced with ') and a proper RFC 5987 filename*=UTF-8''... parameter with percent encoding
• This brings GetObject in line with GetShareLink, which already uses encodeURIComponent() for the filename

Test plan

• Upload a file with double quotes in the name and verify it downloads correctly
• Upload a file with non-ASCII characters (e.g., 日本語.pdf) and verify the downloaded filename is correct
• Verify normal filenames still download with the correct name

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	r2-explorer-docs	132583f	Commit Preview URL Branch Preview URL	Mar 07 2026, 05:48 PM

[G4brym]

Automated Code Review — APPROVED ✅

Review Scores: 5/5 reviewers approved

Summary

Reviewed a focused security fix that sanitizes filenames in the Content-Disposition header to prevent header injection via double quotes. The fix adds an ASCII-safe filename parameter and a proper RFC 5987 filename* parameter with percent encoding. Clean, correct, and consistent with the existing GetShareLink implementation.

Review Perspectives

1. Correctness: ✅ Properly extracts and sanitizes filename with appropriate fallback. ASCII-safe regex and quote replacement are correct.
2. Security: ✅ Fixes the header injection vulnerability. CRLF and double-quote injection vectors are properly neutralized.
3. Performance: ✅ Negligible overhead — two regex replacements and one encodeURIComponent call on a short string.
4. Code Quality: ✅ Clean, readable code with clear variable names. Follows existing project conventions.
5. Testing: ✅ Manual test plan is reasonable for this focused fix. Low risk of regression.

Minor Notes (non-blocking)

• encodeURIComponent() doesn't encode single quotes ('), which is technically non-compliant with RFC 5987's attr-char grammar. In practice browsers handle this fine, and it's consistent with GetShareLink. If you wanted full compliance, you could add .replace(/'/g, "%27") to the encodeURIComponent result — but this is entirely optional.

🤖 Automated review by prodboard