Repository: gofiber/fiber
File: res.go (Go)

Code before:
// headerContainsValue checks if a header value already contains the given value
// as a comma-separated element. Per RFC 9110, list elements are separated by commas
// with optional whitespace (OWS) around them.
func headerContainsValue(header, value string) bool {
	// Empty value should never match
	if value == "" {
		return false
	}

	// Exact match (single value header)
	if header == value {
		return true
	}

	// Check each comma-separated element, handling optional whitespace (OWS)
	for part := range strings.SplitSeq(header, ",") {
		if utils.TrimSpace(part) == value {
			return true
		}
	}

	return false
}

func sanitizeFilename(filename string) string {
	sanitized := strings.Map(func(r rune) rune {
		if unicode.IsControl(r) {
			return -1
		}
		return r
	}, filename)
	sanitized = utils.TrimSpace(sanitized)
	if sanitized == "" {
		return "download"
	}
	return sanitized
}

// Attachment sets the HTTP response Content-Disposition header field to attachment.
func (r *DefaultRes) Attachment(filename ...string) {
	if len(filename) > 0 {
		fname := filepath.Base(filename[0])
		fname = sanitizeFilename(fname)
		r.Type(filepath.Ext(fname))
		app := r.c.app
		var quoted string
		if app.isASCII(fname) {
			quoted = app.quoteString(fname)
		} else {
			quoted = app.quoteRawString(fname)
		}

Review comment (performance):
```go
/// StripControlChars removes ASCII control characters (0x00-0x1F, 0x7F) from a string.
// Zero allocation when no control characters are present.
func StripControlChars(s string) string {
	for i := 0; i < len(s); i++ {
		c := s[i]
		if c < 0x20 || c == 0x7F {
			return stripControlCharsSlow(s, i)
		}
	}
	return s
}

func stripControlCharsSlow(s string, firstBad int) string {
	buf := make([]byte, 0, len(s))
	buf = append(buf, s[:firstBad]...)
	for i := firstBad; i < len(s); i++ {
		c := s[i]
		if c >= 0x20 && c != 0x7F {
			buf = append(buf, c)
		}
	}
	return string(buf)
}
```

Code after:

// headerContainsValue checks if a header value already contains the given value
// as a comma-separated element. Per RFC 9110, list elements are separated by commas
// with optional whitespace (OWS) around them.
func headerContainsValue(header, value string) bool {
	// Empty value should never match
	if value == "" {
		return false
	}

	// Exact match (single value header)
	if header == value {
		return true
	}

	// Check each comma-separated element, handling optional whitespace (OWS)
	for part := range strings.SplitSeq(header, ",") {
		if utils.TrimSpace(part) == value {
			return true
		}
	}

	return false
}

func sanitizeFilename(filename string) string {
	for _, r := range filename {
		if unicode.IsControl(r) {
			b := make([]byte, 0, len(filename))
			for _, rr := range filename {
				if !unicode.IsControl(rr) {
					b = utf8.AppendRune(b, rr)
				}
			}
			return utils.TrimSpace(string(b))
		}
	}

	return utils.TrimSpace(filename)
}

func fallbackFilenameIfInvalid(filename string) string {
	if filename == "" || filename == "." {
		return "download"
	}

	return filename
}

// Attachment sets the HTTP response Content-Disposition header field to attachment.
func (r *DefaultRes) Attachment(filename ...string) {