Downloads start to get encased in Quotes

Question

I have recently experienced an issue with code that was working fine but then started to include quotes around the filename.

We have recently upgraded our server to PHP 7.2 and think this might be the cause of the change but was wanting to see if anyone might know for sure.

We are running Laravel 5.5 app on Ubuntu server with PHP 7.2 and has been observed to work and no longer work in Chrome (the main browser we use)

The following code was working fine for months:

$file = Storage::disk('s3')->get($location);

$headers = [
        'Content-Type' => 'xml',
        'Content-Description' => 'File Transfer',
        'Content-Disposition' => "attachment; filename='" . $realName . "'",
        'filename'=> $realName
    ];

return response($file, 200, $headers);

This would download example.xml fine

However it recently started to download 'example.xml' requiring me to remove the quotes to this:

$file = Storage::disk('s3')->get($location);

$headers = [
        'Content-Type' => 'xml',
        'Content-Description' => 'File Transfer',
        'Content-Disposition' => 'attachment; filename=' . $realName,
        'filename'=> $realName
    ];

return response($file, 200, $headers);

I have seen this problem with multiple file types and so is not file type related.

I am just seeking to discover the cause of this problem especially since the inclusion of the quotes is from what I understand is needed for backwards browser compatibility.

** Update **

I have found this related question but it does not answer the question that I am after:

PDF downloads surrounded by single quotes?

** Update 2 **

I have tested the signle quotes with multiple browsers and it does not work with Chrome and Firefox but does work with Internet Explorer & Edge at current versions.

Is $file a path or a File object? What's the value of $realName? — Travis Britz, Feb 25 '19 at 02:00
Single quotes were never valid. You should use double quotes. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition — lufc, Feb 25 '19 at 02:35
@lufc Thanks for sharing that. I was using a colleges code here and was working so did not think twice about it till it stopped working — Josh, Feb 25 '19 at 02:43
No probs. I suspect it was a browser update which stopped it from working. — lufc, Feb 25 '19 at 02:47

Travis Britz · Accepted Answer · 2019-02-28T01:38:45.680

2

Try this:

'Content-Disposition' => "attachment; filename=\"$realName\"",

It would seem that quoting the filename with single quotes is not valid: https://stackoverflow.com/a/31976390/6038111

Without the double quotes, my guess is that the browser is assuming the single quotes are part of the filename. I can't tell you what changed that caused it to stop working the way it was before, but I might guess that your browser updated and no longer supports the invalid single quoting.

Edit: This does indeed look like Chrome 72 changed its behavior: https://bugs.chromium.org/p/chromium/issues/detail?id=927913

Another Laravel-specific alternative is the built-in file download methods that are part of the storage system. This way you don't have to think about single vs. double quotes:

return Storage::disk('s3')->download($location, $realName, [
    'Content-Type' => 'text/xml',
    'Content-Description' => 'File Transfer',
]);

Note: This will first download the file to your server before sending it to the user (just like your code does), which adds latency due to the additional trip. Anyone coming here from Google might want to check out url() and temporaryUrl() available with S3, Rackspace, and any other filesystem drivers that support it: https://laravel.com/docs/5.7/filesystem#file-urls

edited Feb 28 '19 at 01:38

answered Feb 25 '19 at 02:17

Travis Britz

5,094
2
20
35

Thanks for the response Travis. I had seen about the escaped double quotes but not the single quotes not being valid – Josh Feb 25 '19 at 02:21
The weird thing is that up until about a month ago the single quotes worked fine. – Josh Feb 25 '19 at 02:23
I can't tell you why it worked, but like I said I would guess that your browser used to support single quotes even though they're invalid according to the spec. I've also updated with an alternative for downloading which is specific to Laravel – Travis Britz Feb 25 '19 at 02:27
Thanks Travis. I did not realise that would work. I will have to remember that one for next time I am working with downloads from S3 – Josh Feb 25 '19 at 02:28
@Josh It looks like it was chrome 72 that changed: https://bugs.chromium.org/p/chromium/issues/detail?id=927913 – Travis Britz Feb 28 '19 at 00:56
Thanks Travis that is exactly what I was looking for. – Josh Feb 28 '19 at 00:59

Downloads start to get encased in Quotes

1 Answers1