From 8a6c31ca3915a51344a372af452af44d9792186a Mon Sep 17 00:00:00 2001
From: xiaoxiyao <xiyao.luoxiao@gmail.com>
Date: Tue, 2 Jun 2026 16:13:43 +0800
Subject: [PATCH] fix(sub): escape Clash subscription profile filename header

---
 sub/subController.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sub/subController.go b/sub/subController.go
index 99961c02..05569a54 100644
--- a/sub/subController.go
+++ b/sub/subController.go
@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"os"
 	"strconv"
 	"strings"
@@ -279,7 +280,7 @@ func (a *SUBController) subClashs(c *gin.Context) {
 		a.ApplyCommonHeaders(c, header, a.updateInterval, a.subTitle, a.subSupportUrl, profileUrl, a.subAnnounce, a.subEnableRouting, a.subRoutingRules)
 		if a.subTitle != "" {
 			// Clash clients commonly use Content-Disposition to choose the imported profile name.
-			c.Writer.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename*=UTF-8''%s`, a.subTitle))
+			c.Writer.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename*=UTF-8''%s`, url.PathEscape(a.subTitle)))
 		}
 		c.Data(200, "application/yaml; charset=utf-8", []byte(clashSub))
 	}