fix(batch-export): harden local download Content-Disposition + doc volume

Address PR #57 review:
- Encode Content-Disposition with an ASCII-only filename fallback plus a
  UTF-8 filename*, mirroring the trace download route, so a crafted export
  file name cannot break or inject the header.
- Document the langfuse_batch_export_data volume in docs/deployment.md
  (volumes table + shared-mount note).

Author: killme2008

docs/deployment.md

@@ -65,18 +65,19 @@ The application default for these variables is `s3`, but this repo's `docker-com
 
 The Compose files use Docker named volumes for every stateful path. Treat these as the deployment's data directory set:
 
-| Volume                     | Mounted path               | Stores                                                                        |
-| -------------------------- | -------------------------- | ----------------------------------------------------------------------------- |
-| `langfuse_postgres_data`   | `/var/lib/postgresql/data` | Postgres application state: users, projects, API keys, prompts, config        |
-| `langfuse_greptimedb_data` | `/greptimedb_data`         | GreptimeDB analytics store: traces, observations, scores, dashboards          |
-| `langfuse_redis_data`      | `/data`                    | Redis queue state                                                             |
-| `langfuse_media_data`      | `/langfuse_media_data`     | Local media uploads when `LANGFUSE_MEDIA_STORAGE_BACKEND=local`               |
-| `langfuse_event_data`      | `/langfuse_event_data`     | Local OTel carrier and eval blobs when `LANGFUSE_EVENT_STORAGE_BACKEND=local` |
-| `langfuse_minio_data`      | `/data` in `minio`         | Optional MinIO bucket data when the `s3` profile is enabled                   |
+| Volume                       | Mounted path                  | Stores                                                                        |
+| ---------------------------- | ----------------------------- | ----------------------------------------------------------------------------- |
+| `langfuse_postgres_data`     | `/var/lib/postgresql/data`    | Postgres application state: users, projects, API keys, prompts, config        |
+| `langfuse_greptimedb_data`   | `/greptimedb_data`            | GreptimeDB analytics store: traces, observations, scores, dashboards          |
+| `langfuse_redis_data`        | `/data`                       | Redis queue state                                                             |
+| `langfuse_media_data`        | `/langfuse_media_data`        | Local media uploads when `LANGFUSE_MEDIA_STORAGE_BACKEND=local`               |
+| `langfuse_event_data`        | `/langfuse_event_data`        | Local OTel carrier and eval blobs when `LANGFUSE_EVENT_STORAGE_BACKEND=local` |
+| `langfuse_batch_export_data` | `/langfuse_batch_export_data` | Local batch-export files when `LANGFUSE_BATCH_EXPORT_STORAGE_BACKEND=local`   |
+| `langfuse_minio_data`        | `/data` in `minio`            | Optional MinIO bucket data when the `s3` profile is enabled                   |
 
 Runtime logs are not written to a separate application log directory by default. Web, worker, the standalone supervisor, Postgres, Redis, and GreptimeDB all write to container stdout/stderr; collect them through `docker compose logs` or your Docker logging driver. If you enable GreptimeDB file logging or replace Docker named volumes with bind mounts, keep the log directory outside the container's writable layer and include it in the same backup/retention plan as `langfuse_greptimedb_data`.
 
-Do not run `docker compose down -v` on a real deployment unless you intentionally want to delete the service data. `docker compose down` removes containers and networks but keeps the named volumes; `down -v` removes them. If you replace the named volumes with bind mounts, keep the same container paths above and make sure the app containers can write to the media/event paths. In the split topology, both `langfuse-web` and `langfuse-worker` must mount the same `langfuse_media_data` and `langfuse_event_data` storage.
+Do not run `docker compose down -v` on a real deployment unless you intentionally want to delete the service data. `docker compose down` removes containers and networks but keeps the named volumes; `down -v` removes them. If you replace the named volumes with bind mounts, keep the same container paths above and make sure the app containers can write to the media/event paths. In the split topology, both `langfuse-web` and `langfuse-worker` must mount the same `langfuse_media_data`, `langfuse_event_data`, and `langfuse_batch_export_data` storage.
 
 ## 2. Migrations run automatically on startup
 

web/src/pages/api/public/batch-exports/[batchExportId]/download.ts

@@ -84,11 +84,17 @@ export default async function handler(
     }
 
     const downloadName = path.basename(token.fileName);
+    // RFC 5987/6266: give an ASCII-only fallback (control chars, quotes, and
+    // non-ASCII stripped so the header cannot be broken or injected) plus a
+    // UTF-8 `filename*` carrying the real name. Mirrors the trace download route.
+    const asciiFallback =
+      downloadName.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_") ||
+      "batch-export";
     res.setHeader("Content-Type", token.contentType);
     res.setHeader("Content-Length", String(size));
     res.setHeader(
       "Content-Disposition",
-      `attachment; filename="${downloadName}"`,
+      `attachment; filename="${asciiFallback}"; filename*=UTF-8''${encodeURIComponent(downloadName)}`,
     );
 
     await pipeline(createReadStream(filePath), res);