fix: encode download Content-Disposition per RFC 6266 and RFC 8187

[hsusul]

What

Encode the ?download= Content-Disposition header per RFC 6266 / RFC 8187.

Fixes #1385. Follows up #735, which fixed the trailing semicolon in the same header.

Why

Renderer.handleDownload used encodeURIComponent output for both parameters:

• filename* — encodeURIComponent leaves ' ( ) * raw, but an RFC 8187 ext-value only allows attr-char unencoded, and ' is its delimiter. John's Resume.pdf → UTF-8''John's%20Resume.pdf is malformed.
• filename — the fallback for clients that ignore filename* is not percent-decoded by anyone, so my file.pdf was saved as my%20file.pdf, and report(1).pdf was sent as an unquoted token containing delimiters.

This is the only place download= becomes a header, so every public, signed and authenticated object and image route is covered.

How

• filename*: percent-encode ' ( ) * on top of encodeURIComponent, giving a value made of attr-char and %XX only.
• filename: printable ASCII fallback — non-ASCII and control characters (so CR/LF can never reach the header), plus " and \ (RFC 6266 Appendix D), become _. It is quoted only when it isn't a valid token, so plain names like testname.png keep today's exact header (the existing assertion in src/test/object.test.ts is unchanged).

download=	before	after
report.pdf	filename=report.pdf; filename*=UTF-8''report.pdf	unchanged
my file.pdf	filename=my%20file.pdf; filename*=UTF-8''my%20file.pdf	filename="my file.pdf"; filename*=UTF-8''my%20file.pdf
John's Resume.pdf	…; filename*=UTF-8''John's%20Resume.pdf	filename="John's Resume.pdf"; filename*=UTF-8''John%27s%20Resume.pdf
naïve.txt	filename=na%C3%AFve.txt; …	filename=na_ve.txt; filename*=UTF-8''na%C3%AFve.txt

Tests

New src/storage/renderer/renderer.test.ts parses the header with the RFC 6266 grammar (token or quoted-string filename) and checks that filename* contains only attr-char/%XX, round-trips the name, and that the fallback is correct. It also covers: no download, empty download, an already-valid token staying byte-identical, non-ASCII, and a CR/LF injection attempt.

6 of the 11 cases fail on master (spaces, apostrophe, parentheses, *, "/\, non-ASCII); the other 5 are guards for behavior that is already correct.

Validation

Local, macOS / Node v24.9.0:

• npm run test:unit — 149 files, 2149 tests passing
• npm run build, npm run lint, git diff --check — clean
• The renderer.ts patches from open PRs feat: allow setting stale-while-revalidate and stale-if-error headers #1369 and fix: cap signed url edge cache ttl #1188 still apply cleanly on top of this change (git apply --check)

Not run: npm run test:integration (needs the Docker Postgres stack; port 5432 is occupied on this machine). Locally, a few unrelated unit tests (s3/index, request-scoped-pg-executor, vector, listObjectsV2 migration gate) fail intermittently under load. They fail the same way on clean master in this environment and pass in upstream CI.

[coveralls]

Coverage Report for CI Build 35739742579

Coverage increased (+0.004%) to 83.396%

Details

• Coverage increased (+0.004%) from the base build.
• Patch coverage: 5 of 5 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	14205
Covered Lines:	12274
Line Coverage:	86.41%
Relevant Branches:	8699
Covered Branches:	6827
Branch Coverage:	78.48%
Branches in Coverage %:	Yes
Coverage Strength:	765.82 hits per line

---

💛 - Coveralls