Is Firefox sanitizing the filename?

What filename does the server send if you check the HTTP response headers in the Network Monitor?

• https://firefox-source-docs.mozilla.org/devtools-user/network_monitor/

Response Headers shows:

content-disposition attachment; filename*=utf-8""; filename=""

Looking at Response Headers in a version of Firefox such as 125, in which downloads are not appended with underscores, the response headers appear to be the same. Screenshot attached of Firefox 127.0.2 Response Headers

Thank you very much for your help.

Please see linked issue https://github.com/Velocidex/velociraptor/issues/3694 this is probably a documentation bug in MDN

Following the reference https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition shows that the `filename*` field must be encoded according to rfc5987 which shows an example:

https://datatracker.ietf.org/doc/html/rfc5987#section-3.2.2

```

  foo: bar; title*=UTF-8%c2%a3%20and%20%e2%82%ac%20rates

```

So it does not include the quotes before and after. While the `filename` parameter should have the quotes:

``` Content-Disposition: attachment; filename="filename.jpg" ```

Yet from the very same MDN reference we have the following example:

``` Content-Disposition: inline Content-Disposition: attachment Content-Disposition: attachment; filename="filename.jpg" Content-Disposition: attachment; filename*="filename.jpg" ```

Which shows quotes around the `filename*` parameter.

So it seems that firefox started to be very literal in following the RFC and considers the quotes as part of the filename now which is why they are replaced with _ . However chrome is still flexible in allowing optional quotes around the `filename*` parameter.

I just tried removing the quotes from `filename*` on FireFox on Windows and this does solve the issue. Probably the MDN documentation should be updated though as well.