Merge branch 'master_after0506' into master_after0506_report02_1

@@ -14,6 +14,7 @@ import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiImplicitParam;
 import io.swagger.annotations.ApiImplicitParam;
 import io.swagger.annotations.ApiOperation;
 import io.swagger.annotations.ApiOperation;
 import java.io.*;
 import java.io.*;
+import java.net.URLDecoder;
 import java.net.URLEncoder;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.nio.charset.StandardCharsets;
 import javax.validation.constraints.NotBlank;
 import javax.validation.constraints.NotBlank;
@@ -60,6 +61,7 @@ public class SecurityDownloadController extends DefaultBaseController {
 
 
     String url = UploadUtil.generatePresignedUrl(record.getUploadType().getCode(),
     String url = UploadUtil.generatePresignedUrl(record.getUploadType().getCode(),
         record.getFilePath());
         record.getFilePath());
+    log.info("fileName===" + fileName);
     if (StringUtils.isNotBlank(fileName)) {
     if (StringUtils.isNotBlank(fileName)) {
       try {
       try {
         url = url + "&fileName=" + URLEncoder.encode(fileName, StandardCharsets.UTF_8.name())
         url = url + "&fileName=" + URLEncoder.encode(fileName, StandardCharsets.UTF_8.name())
@@ -68,6 +70,7 @@ public class SecurityDownloadController extends DefaultBaseController {
         e.printStackTrace();
         e.printStackTrace();
       }
       }
     }
     }
+    log.info("url===" + url);
 
 
     return InvokeResultBuilder.success(url);
     return InvokeResultBuilder.success(url);
   }
   }
@@ -89,13 +92,16 @@ public class SecurityDownloadController extends DefaultBaseController {
       throw new AccessDeniedException();
       throw new AccessDeniedException();
     }
     }
 
 
-    String downloadFileName = StringUtils.isBlank(fileName) ? file.getName() : fileName;
+    log.info("fileName===" + fileName);
+    String normalizedFileName = normalizeFileName(fileName);
+    log.info("normalizedFileName===" + normalizedFileName);
+    String downloadFileName = StringUtils.isBlank(normalizedFileName) ? file.getName() : normalizedFileName;
     String encodedFileName = URLEncoder.encode(downloadFileName, StandardCharsets.UTF_8.name())
     String encodedFileName = URLEncoder.encode(downloadFileName, StandardCharsets.UTF_8.name())
         .replace("+", "%20");
         .replace("+", "%20");
 
 
     response.setContentType("application/octet-stream");
     response.setContentType("application/octet-stream");
     response.setCharacterEncoding(StandardCharsets.UTF_8.name());
     response.setCharacterEncoding(StandardCharsets.UTF_8.name());
-    response.setHeader("Content-Disposition", "attachment;filename=" + encodedFileName);
+    response.setHeader("Content-Disposition", buildContentDisposition(downloadFileName, encodedFileName));
     response.setHeader("Access-Control-Expose-Headers", "Content-Disposition");
     response.setHeader("Access-Control-Expose-Headers", "Content-Disposition");
 
 
     try (InputStream in = new FileInputStream(file)) {
     try (InputStream in = new FileInputStream(file)) {
@@ -107,4 +113,36 @@ public class SecurityDownloadController extends DefaultBaseController {
       response.getOutputStream().flush();
       response.getOutputStream().flush();
     }
     }
   }
   }
+
+  private String buildContentDisposition(String fileName, String encodedFileName) {
+    String fallbackFileName = fileName
+        .replace("\\", "_")
+        .replace("\"", "_");
+    return "attachment; filename=\"" + fallbackFileName + "\"; filename*=UTF-8''"
+        + encodedFileName;
+  }
+
+  private String normalizeFileName(String fileName) {
+    if (StringUtils.isBlank(fileName)) {
+      return fileName;
+    }
+
+    String normalized = fileName;
+    for (int i = 0; i < 2; i++) {
+      if (!normalized.matches(".*%[0-9a-fA-F]{2}.*")) {
+        break;
+      }
+      try {
+        String decoded = URLDecoder.decode(normalized, StandardCharsets.UTF_8.name());
+        if (StringUtils.equals(decoded, normalized)) {
+          break;
+        }
+        normalized = decoded;
+      } catch (Exception e) {
+        break;
+      }
+    }
+
+    return normalized;
+  }
 }
 }