Summary
Attachment filenames are placed inside a Content-Disposition: attachment; filename="..." parameter. The current quoteFilename helper strips CR/LF and the quoted-string specials (" and \) to prevent header injection and quote breakout, which is safe — but it does not RFC 2047 / RFC 2231 encode non-ASCII filenames.
As a result, a filename containing non-ASCII characters (e.g. résumé.pdf, 報告書.pdf) remains as raw bytes inside the quoted string. It stays safe and within a valid quoted value, but may not render correctly in all mail clients.
Possible direction
- Encode non-ASCII filenames using RFC 2231 (
filename*=UTF-8''...) alongside a sanitized ASCII filename="..." fallback for older clients.
Notes
- This is a correctness/interoperability improvement, not a security issue — injection and quote-breakout are already prevented (see
mail.quoteFilename and its tests).
Priority
Low — nice to have. ASCII filenames are unaffected.
Summary
Attachment filenames are placed inside a
Content-Disposition: attachment; filename="..."parameter. The currentquoteFilenamehelper strips CR/LF and the quoted-string specials ("and\) to prevent header injection and quote breakout, which is safe — but it does not RFC 2047 / RFC 2231 encode non-ASCII filenames.As a result, a filename containing non-ASCII characters (e.g.
résumé.pdf,報告書.pdf) remains as raw bytes inside the quoted string. It stays safe and within a valid quoted value, but may not render correctly in all mail clients.Possible direction
filename*=UTF-8''...) alongside a sanitized ASCIIfilename="..."fallback for older clients.Notes
mail.quoteFilenameand its tests).Priority
Low — nice to have. ASCII filenames are unaffected.