fix: escape filename (#21)

close #19

src/args.rs

@@ -143,7 +143,7 @@ impl Args {
         let uri_prefix = if path_prefix.is_empty() {
             "/".to_owned()
         } else {
-            format!("/{}/", &path_prefix)
+            format!("/{}/", encode_uri(&path_prefix))
         };
         let cors = matches.is_present("cors");
         let auth = match matches.value_of("auth") {
@@ -237,3 +237,8 @@ pub fn load_private_key(filename: &str) -> BoxResult<PrivateKey> {
     }
     Ok(PrivateKey(keys[0].to_owned()))
 }
+
+pub fn encode_uri(v: &str) -> String {
+    let parts: Vec<_> = v.split('/').map(urlencoding::encode).collect();
+    parts.join("/")
+}

src/main.rs

@@ -4,7 +4,7 @@ mod server;
 
 pub type BoxResult<T> = Result<T, Box<dyn std::error::Error>>;
 
-use crate::args::{matches, Args};
+use crate::args::{encode_uri, matches, Args};
 use crate::server::serve;
 
 #[tokio::main]

src/server.rs

@@ -1,5 +1,5 @@
 use crate::auth::{generate_www_auth, valid_digest};
-use crate::{Args, BoxResult};
+use crate::{encode_uri, Args, BoxResult};
 
 use async_walkdir::WalkDir;
 use async_zip::write::{EntryOptions, ZipFileWriter};
@@ -370,7 +370,11 @@ impl InnerService {
         *res.body_mut() = Body::wrap_stream(stream);
         res.headers_mut().insert(
             CONTENT_DISPOSITION,
-            HeaderValue::from_str(&format!("attachment; filename=\"{}.zip\"", filename,)).unwrap(),
+            HeaderValue::from_str(&format!(
+                "attachment; filename=\"{}.zip\"",
+                encode_uri(filename),
+            ))
+            .unwrap(),
         );
         Ok(())
     }
@@ -821,7 +825,10 @@ impl PathItem {
 <D:status>HTTP/1.1 200 OK</D:status>
 </D:propstat>
 </D:response>"#,
-                prefix, self.name, self.base_name, mtime
+                prefix,
+                encode_uri(&self.name),
+                urlencoding::encode(&self.base_name),
+                mtime
             ),
             PathType::File | PathType::SymlinkFile => format!(
                 r#"<D:response>
@@ -837,8 +844,8 @@ impl PathItem {
 </D:propstat>
 </D:response>"#,
                 prefix,
-                self.name,
-                self.base_name,
+                encode_uri(&self.name),
+                urlencoding::encode(&self.base_name),
                 self.size.unwrap_or_default(),
                 mtime
             ),