My test code looks like this:

@app.get('/file')
def return_file():
    return send_file(BytesIO(b"test"), download_name="(тест.txt")

Notice the ( in download_name. Currently response headers look like this:

Content-Disposition: attachment; filename="("; filename*="UTF-8''(%D1%82%D0%B5%D1%81%D1%82"

Firefox uses filename* and downloads file with intended name ((тест.txt). Both Chrome (106.0.5249.103) and macOS Safari (16.0 (17614.1.25.9.10, 17614)) download files with name (.

Both opening and closing braces in download_name cause this behaviour.

Environment:

• Python version: 3.9
• Flask version: 2.2.2