fix: escape backslash and double quote in the ASCII Content-Disposition fallback

A bitstream name containing a double quote closed the quoted-string early and
produced an invalid Content-Disposition, which browsers reject. The allzip and
by-handle paths in this branch already escape; this brings the single-file
download path in line and adds an IT for it. This is a deliberate deviation
from vanilla HttpHeadersInitializer, which still has the bug.

Also fixes the continuation indent of an expected value in the same IT.

Author: milanmajchrak

dspace-server-webapp/src/main/java/org/dspace/app/rest/utils/HttpHeadersInitializer.java

@@ -283,7 +283,9 @@ private String createFallbackAsciiName(String originalFilename) {
         }
         String normalized = Normalizer.normalize(originalFilename, Normalizer.Form.NFD);
         String withoutAccents = normalized.replaceAll("\\p{InCombiningDiacriticalMarks}+", "");
-        return withoutAccents.replaceAll("[^\\x00-\\x7F]", "");
+        return withoutAccents.replaceAll("[^\\x00-\\x7F]", "")
+                .replace("\\", "\\\\")
+                .replace("\"", "\\\"");
     }
 
     /**

dspace-server-webapp/src/test/java/org/dspace/app/rest/BitstreamRestControllerIT.java

@@ -365,9 +365,8 @@ public void testBitstreamName() throws Exception {
         String bitstreamContent = "0123456789";
         String bitstreamName = "ภาษาไทย-com-acentuação.pdf";
         String expectedAscii = "-com-acentuacao.pdf";
-        String expectedUtf8Encoded =
-        "%E0%B8%A0%E0%B8%B2%E0%B8%A9%E0%B8%B2%E0%B9%84%E0%B8%97%E0%B8%A2-"
-        + "com-acentua%C3%A7%C3%A3o.pdf";
+        String expectedUtf8Encoded = "%E0%B8%A0%E0%B8%B2%E0%B8%A9%E0%B8%B2%E0%B9%84%E0%B8%97%E0%B8%A2-"
+            + "com-acentua%C3%A7%C3%A3o.pdf";
 
         try (InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
 
@@ -397,6 +396,48 @@ public void testBitstreamName() throws Exception {
             ));
     }
 
+    @Test
+    public void testBitstreamNameWithQuote() throws Exception {
+
+        context.turnOffAuthorisationSystem();
+
+        parentCommunity = CommunityBuilder
+            .createCommunity(context)
+            .build();
+
+        Collection collection = CollectionBuilder
+            .createCollection(context, parentCommunity)
+            .build();
+
+        String bitstreamContent = "0123456789";
+        String bitstreamName = "file \"quoted\".txt";
+        String expectedAscii = "file \\\"quoted\\\".txt";
+        String expectedUtf8Encoded = "file%20%22quoted%22.txt";
+
+        try (InputStream is = IOUtils.toInputStream(bitstreamContent, CharEncoding.UTF_8)) {
+
+            Item item = ItemBuilder
+                .createItem(context, collection)
+                .build();
+
+            bitstream = BitstreamBuilder
+                .createBitstream(context, item, is)
+                .withName(bitstreamName)
+                .build();
+        }
+
+        context.restoreAuthSystemState();
+
+        getClient().perform(get("/api/core/bitstreams/" + bitstream.getID() + "/content"))
+            .andExpect(status().isOk())
+            .andExpect(header().string(
+                "Content-Disposition",
+                String.format("attachment; filename=\"%s\"; filename*=UTF-8''%s",
+                              expectedAscii,
+                              expectedUtf8Encoded)
+            ));
+    }
+
     @Test
     public void testBitstreamNotFound() throws Exception {
         getClient().perform(get("/api/core/bitstreams/" + UUID.randomUUID() + "/content"))