Fix Force Enclosure and Escape character combinaison and Header (#588)

When Writer::forceEnclosure() runs with an empty escape character, the two
step str_replace map built in resetProperties() cancels itself: the first
pass doubles every enclosure and the second pass (which degenerates to the
same "" search) collapses it back. Embedded enclosures are therefore never
doubled and the writer emits CSV its own Reader parses incorrectly.

Build the replacement map as plain RFC-4180 enclosure doubling when the
escape is empty, matching the fputcsv based necessaryEnclosure path. The
non-empty escape branch is unchanged.

Author: nyamsprod

CHANGELOG.md

@@ -19,6 +19,7 @@ All Notable changes to `Csv` will be documented in this file
 - `Writer::forceEnclosure` now doubles embedded enclosures when the escape character is the empty string.
 - `EscapeFormula` round-trip now preserves fields starting with the escape character
 - BOM handling is re-written to fix [#586]([https://github](https://github.com/thephpleague/csv/issues/586))
+- CSV Header during CSV download.
 
 ### Remove
 

src/HttpHeaders.php

@@ -50,9 +50,9 @@ public static function forFileDownload(string $filename, string $contentType): v
         $disposition = 'attachment;filename="'.str_replace('"', '\\"', $fallbackName).'"';
         if ($filename !== $fallbackName) {
             $disposition .= ";filename*=UTF-8''".preg_replace_callback(
-                '/[%"\x00-\x1F\x7F-\xFF]/',
-                static fn (array $matches): string => strtolower(rawurlencode($matches[0])),
-                $filename
+                pattern:'/[^A-Za-z0-9!#$&+\-.^_`|~]/',
+                callback: static fn (array $matches): string => strtolower(rawurlencode($matches[0])),
+                subject: $filename
             );
         }
 

src/Writer.php

@@ -75,8 +75,11 @@ protected function insertRecord(array $record): int|false
             self::ENCLOSE_ALL => $this->document->fwrite(implode(
                 $this->delimiter,
                 array_map(
-                    fn ($content) => $this->enclosure.$content.$this->enclosure,
-                    str_replace($this->enclosure_replace[0], $this->enclosure_replace[1], $record)
+                    fn ($content): string =>
+                         $this->enclosure
+                         .str_replace($this->enclosure, $this->enclosure.$this->enclosure, (string) $content)
+                         .$this->enclosure,
+                    $record
                 )
             ).$this->newline),
             self::ENCLOSE_NONE => $this->document->fwrite(implode($this->delimiter, $record).$this->newline),

src/WriterTest.php

@@ -189,7 +189,7 @@ public function testForceEnclosure(): void
 
         self::assertStringContainsString('"1","2"'."\n", $csv);
         self::assertStringContainsString('"value 2-0","value 2-1"'."\n", $csv);
-        self::assertStringContainsString('"to""to","foo\"bar"'."\n", $csv);
+        self::assertStringContainsString('"to""to","foo\""bar"'."\n", $csv);
 
         $writer->necessaryEnclosure();
         self::assertFalse($writer->encloseAll());
@@ -258,7 +258,22 @@ public function testForceEnclosureWithLegacyEscapeIsUnchanged(): void
         $writer->insertOne(['to"to', 'foo\"bar']);
 
         // the legacy non-empty escape path must keep doubling once, never twice
-        self::assertSame('"to""to","foo\"bar"'."\n", $writer->toString());
+        self::assertSame('"to""to","foo\""bar"'."\n", $writer->toString());
+    }
+
+    public function test_security_fix_force_enclosure(): void
+    {
+        $record = ['a"b,INJECTED', 'col2'];
+        $writer = Writer::fromString()
+            ->forceEnclosure();
+
+        $writer->insertOne($record);
+        self::assertSame('"a""b,INJECTED","col2"'."\n", $writer->toString());
+
+        $reader = Reader::fromString($writer->toString())
+            ->setEscape('');
+
+        self::assertSame($record, $reader->first());
     }
 
     public function testAddValidationRules(): void