Handle non-latin1 filename headers

app/main.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import io
 import re
 import unicodedata
-from urllib.parse import quote
+from urllib.parse import quote_from_bytes
 from typing import Any, Dict, Literal, Optional
 
 from fastapi import FastAPI, HTTPException
@@ -97,14 +97,19 @@ def compile_pdf(req: CompileRequest):
     safe_base = safe_base.encode("ascii", "ignore").decode("ascii") or "document"
     safe_base = re.sub(r"[^A-Za-z0-9_.-]+", "-", safe_base).strip("-") or "document"
     filename = f"{safe_base}.pdf"
-    encoded_name = quote(f"{raw_name}.pdf")
+    encoded_name = quote_from_bytes(f"{raw_name}.pdf".encode("utf-8"))
+    content_disposition = (
+        f'attachment; filename="{filename}"; filename*=UTF-8\'\'{encoded_name}'
+    )
+    try:
+        content_disposition.encode("latin-1")
+    except UnicodeEncodeError:
+        content_disposition = f'attachment; filename="{filename}"'
 
     return StreamingResponse(
         io.BytesIO(pdf_bytes),
         media_type="application/pdf",
         headers={
-            "Content-Disposition": (
-                f'attachment; filename="{filename}"; filename*=UTF-8\'\'{encoded_name}'
-            )
+            "Content-Disposition": content_disposition
         },
     )

app/renderer.py

@@ -1,11 +1,13 @@
 from __future__ import annotations
 
+import html
 import json
 import re
 from datetime import datetime
 from typing import Any, Dict, Literal, Union
 
 from jinja2 import Environment, FileSystemLoader, select_autoescape
+from markupsafe import Markup
 from weasyprint import HTML
 
 from .config import BASE_DIR
@@ -172,6 +174,22 @@ def _resolve_template(doc: Dict[str, Any]) -> str:
     return "InternalModule.html.j2"
 
 
+# =========================
+#  SANITIZACIÓN DE TEXTOS
+# =========================
+def _sanitize_doc(value: Any) -> Any:
+    if isinstance(value, dict):
+        return {key: _sanitize_doc(val) for key, val in value.items()}
+    if isinstance(value, list):
+        return [_sanitize_doc(val) for val in value]
+    if isinstance(value, tuple):
+        return tuple(_sanitize_doc(val) for val in value)
+    if isinstance(value, str):
+        # Escapar etiquetas HTML para evitar que el contenido altere el render.
+        return Markup(html.escape(value))
+    return value
+
+
 # =========================
 #  RENDER HTML
 # =========================
@@ -179,7 +197,7 @@ RenderMode = Literal["html", "pdf"]
 
 
 def render_html(doc: Union[str, Dict[str, Any]], mode: RenderMode = "html") -> str:
-    doc = normalize_doc(doc)
+    doc = _sanitize_doc(normalize_doc(doc))
 
     template_name = _resolve_template(doc)
     template = env.get_template(template_name)