Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin

An attacker who can control the filename parameter passed to `Context.FileAttachment` can inject double-quote characters to break out of the intended filename value in the `Content-Disposition` header. For example, a filename like `"setup.bat";x=.txt"` causes the header to be sent with `filename="setup.bat"`, making the downloaded file appear as `setup.bat` instead of the full malicious string. This can trick users into opening a file they believe is a harmless `.txt` file when it is actually a `.bat` script. No authentication is required if the application exposes a file-download endpoint that accepts user-supplied filenames.

The vulnerability is in the `FileAttachment` method in `context.go`. When the filename is ASCII, the code directly concatenates the user-supplied filename into the `Content-Disposition` header without escaping special characters such as double quotes or backslashes. The patch introduces an `escapeQuotes` helper function and a `quoteEscaper` replacer to properly escape backslashes and double quotes before insertion into the header.

The patch adds a `quoteEscaper` using `strings.NewReplacer` that replaces backslashes with `\\` and double quotes with `\"`. A new `escapeQuotes` function applies this replacer to the filename string. In `FileAttachment`, the ASCII branch now wraps the filename with `escapeQuotes(filename)` instead of using the raw filename. This prevents an attacker from injecting double-quote characters to alter the `Content-Disposition` header structure. The test in `context_test.go` confirms that a malicious filename like `tampering_field.sh"; \"; dummy=.go` is properly escaped to `tampering_field.sh\"; \\\"; dummy=.go`.