SUM-SEC-16 [P2][16/20][Med] CSRF/signed tickets for report PDF GET; sanitize Content-Disposition

[CHINMAYVIVEK]

ID: SUM-SEC-16
Wave: P2
Severity: Medium (export) / Low–Med (header)
Labels: security, export, csrf, P2
Branch: fix/SUM-SEC-16-export-csrf-filename
Languages: Go
CWE: CWE-352 / CWE-113

Summary

ReportPrintHandler is session-only GET without CSRF (unlike some exports). Top-level cross-site navigation with Lax cookies can fetch confidential PDFs. Export Content-Disposition concatenates model/filename without RFC 5987 quoting → header injection risk.

Acceptance criteria

• PDF print: CSRF header/body, POST, or short-lived signed download ticket
• Sanitize filenames (filename*= UTF-8); reject CR/LF / quotes
• Tests for disposition encoding and unauthorized print

Files to check / change

• sumeru/core/server/web/report_routes.go (ReportPrintHandler ~L23–37)
• sumeru/core/server/web/export_handlers.go (~L93)