{"record":{"id":"98677b2aeae7216a","repo":"symfony/http-foundation","slug":"the-disposition-must-be-either-s-or-s","errorCode":null,"errorMessage":"The disposition must be either \"%s\" or \"%s\".","messagePattern":"The disposition must be either \"(.+?)\" or \"(.+?)\"\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"HeaderUtils.php","lineNumber":168,"sourceCode":"    }\n\n    /**\n     * Generates an HTTP Content-Disposition field-value.\n     *\n     * @param string $disposition      One of \"inline\" or \"attachment\"\n     * @param string $filename         A unicode string\n     * @param string $filenameFallback A string containing only ASCII characters that\n     *                                 is semantically equivalent to $filename. If the filename is already ASCII,\n     *                                 it can be omitted, or just copied from $filename\n     *\n     * @throws \\InvalidArgumentException\n     *\n     * @see RFC 6266\n     */\n    public static function makeDisposition(string $disposition, string $filename, string $filenameFallback = ''): string\n    {\n        if (!\\in_array($disposition, [self::DISPOSITION_ATTACHMENT, self::DISPOSITION_INLINE], true)) {\n            throw new \\InvalidArgumentException(\\sprintf('The disposition must be either \"%s\" or \"%s\".', self::DISPOSITION_ATTACHMENT, self::DISPOSITION_INLINE));\n        }\n\n        if ('' === $filenameFallback) {\n            $filenameFallback = $filename;\n        }\n\n        // filenameFallback is not ASCII.\n        if (!preg_match('/^[\\x20-\\x7e]*$/', $filenameFallback)) {\n            throw new \\InvalidArgumentException('The filename fallback must only contain ASCII characters.');\n        }\n\n        // percent characters aren't safe in fallback.\n        if (str_contains($filenameFallback, '%')) {\n            throw new \\InvalidArgumentException('The filename fallback cannot contain the \"%\" character.');\n        }\n\n        // path separators aren't allowed in either.\n        if (str_contains($filename, '/') || str_contains($filename, '\\\\') || str_contains($filenameFallback, '/') || str_contains($filenameFallback, '\\\\')) {","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/symfony/http-foundation/blob/5aea19cd678fa4140f6108406f1096de5e9ed6e4/HeaderUtils.php#L150-L186","documentation":"HeaderUtils::makeDisposition() only accepts two disposition types: self::DISPOSITION_ATTACHMENT ('attachment') and self::DISPOSITION_INLINE ('inline'), compared strictly with in_array(..., true). Any other string (typo, capitalized, empty) throws this InvalidArgumentException, because RFC 6266 defines only these two disposition types for the Content-Disposition header.","triggerScenarios":"Calling HeaderUtils::makeDisposition() with a $disposition argument other than the exact strings 'attachment' or 'inline' — e.g. 'attachement' (typo), 'ATTACHMENT' (wrong case), 'attachment ' (trailing space), or a variable holding an unexpected value.","commonSituations":"Typing the disposition constant as a raw string instead of using the class constants HeaderUtils::DISPOSITION_ATTACHMENT / DISPOSITION_INLINE; building the disposition dynamically from user input or config; upgrading Symfony where the check became strict (===) so previously-tolerated case variants now fail.","solutions":["Use HeaderUtils::DISPOSITION_ATTACHMENT or HeaderUtils::DISPOSITION_INLINE constants instead of literal strings","Check the exact spelling and case: only lowercase 'attachment' and 'inline' are valid","If the value comes from config/user input, whitelist and map it to the two allowed constants before calling","Wrap the call in try/catch InvalidArgumentException and default to DISPOSITION_ATTACHMENT"],"exampleFix":"// before\nHeaderUtils::makeDisposition('attachment', 'report.pdf'); // or 'ATTACHMENT'\n// after\nuse Symfony\\Component\\HttpFoundation\\HeaderUtils;\nHeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, 'report.pdf');","handlingStrategy":"validation","validationCode":"if (!in_array($disposition, [HeaderUtils::DISPOSITION_ATTACHMENT, HeaderUtils::DISPOSITION_INLINE], true)) {\n    $disposition = HeaderUtils::DISPOSITION_ATTACHMENT;\n}","typeGuard":"function isValidDisposition(?string $d): bool {\n    return $d === HeaderUtils::DISPOSITION_ATTACHMENT || $d === HeaderUtils::DISPOSITION_INLINE;\n}","tryCatchPattern":"try {\n    $header = HeaderUtils::makeDisposition($disposition, $filename);\n} catch (\\InvalidArgumentException $e) {\n    $header = HeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, $filename);\n}","preventionTips":["Always use the HeaderUtils::DISPOSITION_* class constants, never string literals","Strict-compare config/user input against the two allowed values before calling","Map external disposition values through a whitelist lookup with a safe default"],"tags":["php","http-headers","invalid-argument","symfony"],"backgroundTag":"invalid-enum-value","analyzedSha":"5aea19cd678fa4140f6108406f1096de5e9ed6e4","analyzedAt":"2026-09-13T01:52:22.855Z","contentChangedAt":"2026-09-13T01:52:22.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}