ContentDispositionFilenameNeedsQuoting

warning native on by default quick-fix

Group: Probable bugs

Quote the Content-Disposition filename.

Example

Finding:

<?php
header("Content-Disposition: attachment; filename=monthly notes.pdf");

Reported:

• line 2: Quote the Content-Disposition filename.

Detection

• Parse a literal Content-Disposition header and identify an unquoted filename parameter containing characters outside HTTP token grammar, including whitespace. Report the full header call. Split the header value into parameters only on semicolons outside double-quoted strings, honouring backslash escapes inside them, so ; filename= text inside another parameter's quoted value is not a filename parameter. Recognize filename-star as separate syntax.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias or unknown call involving the tracked value. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Already quoted filenames, token-safe filenames, RFC extended filename parameters, unknown values, ambiguous multiple filename parameters and header values with an unterminated quoted string (parameter boundaries unknown) are excluded.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

For one unambiguous literal header containing one unquoted filename parameter, quote its value and escape double quotes/backslashes as HTTP quoted-string syntax, then encode the replacement PHP literal without altering its evaluated bytes elsewhere. Suppress for CR/LF, ambiguous parameter boundaries, interpolation or comment loss.

All edits use exact byte ranges, preserve comments and evaluation order, and require syntax supported by the target PHP version. A fix must never add an evaluation or silently change unrelated arguments.

PHP versions

Available throughout PHP 5.3–8.5.

Configure

In custos.json:

{
  "rules": {
    "ContentDispositionFilenameNeedsQuoting": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ContentDispositionFilenameNeedsQuoting