Merge pull request 'Sanitize Content-Disposition filename in downloads' (#43) from fix/content-disposition-injection into main

Reviewed-on: https://git.ts.mattnite.net/mattnite/forgejo-tickets/pulls/43

internal/handlers/public/tickets.go

@@ -2,6 +2,7 @@ package public
 
 import (
 	"io"
+	"mime"
 	"net/http"
 	"sort"
 	"strconv"
@@ -531,7 +532,7 @@ func (h *TicketHandler) proxyAssetDownload(c *gin.Context, assetURL, filename st
 		contentType = "application/octet-stream"
 	}
 	c.Header("Content-Type", contentType)
-	c.Header("Content-Disposition", "attachment; filename=\""+filename+"\"")
+	c.Header("Content-Disposition", mime.FormatMediaType("attachment", map[string]string{"filename": filename}))
 	if cl := resp.Header.Get("Content-Length"); cl != "" {
 		c.Header("Content-Length", cl)
 	}