Should \u202f get sanitized?

[rodrigoborgesdeoliveira]

When streaming a filename with a \u202f character using express.js, it throws an error when setting the Content-Disposition header:

// throws ERR_INVALID_CHAR
res.setHeader(
    'Content-Disposition',
    'attachment; filename="example\u202f.txt"',
);

After sanitizing a string with the \u202f character, it is still present in the string. Should it get sanitized by sanitize-filename or is that expected?

[parshap]

It looks like node's response.setHeader is what is rejecting the string. Since this module is about sanitizing strings to be safe as filenames in filesystems, I'm not sure sanitizing \u202f or other control characters response.setHeader rejects is appropriate. It looks like this package might help make sure your filename is safe for header use: https://github.com/jshttp/content-disposition

[rodrigoborgesdeoliveira]

Got it. Thanks, @parshap.