From c392fff31b6bce61c49305f551169580756a4f29 Mon Sep 17 00:00:00 2001
From: John McPherson <johnmcp@microsoft.com>
Date: Wed, 21 Jan 2026 14:56:52 -0800
Subject: [PATCH] Escape caller and add test

---
 src/AppInstallerCLITests/HttpClientHelper.cpp | 10 ++++++++++
 src/AppInstallerCommonCore/Runtime.cpp        |  4 +++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/AppInstallerCLITests/HttpClientHelper.cpp b/src/AppInstallerCLITests/HttpClientHelper.cpp
index 8ce289fcd4..0705c815b2 100644
--- a/src/AppInstallerCLITests/HttpClientHelper.cpp
+++ b/src/AppInstallerCLITests/HttpClientHelper.cpp
@@ -9,6 +9,7 @@
 #include <winget/Certificates.h>
 #include <winget/HttpClientHelper.h>
 #include <CertificateResources.h>
+#include <winget/JsonUtil.h>
 
 using namespace AppInstaller::Http;
 using namespace AppInstaller::Runtime;
@@ -79,3 +80,12 @@ TEST_CASE("HttpClientHelper_PinningConfiguration", "[RestSource]")
 
     REQUIRE_THROWS_HR(helper.HandleGet(L"https://github.com"), APPINSTALLER_CLI_ERROR_PINNED_CERTIFICATE_MISMATCH);
 }
+
+TEST_CASE("HttpClientHelper_CallerCharacters", "[RestSource]")
+{
+    HttpClientHelper::HttpRequestHeaders headers;
+    headers.emplace(web::http::header_names::user_agent, AppInstaller::JSON::GetUtilityString(AppInstaller::Runtime::GetUserAgent("\xe6\xb5\x8b\xe8\xaf\x95")));
+
+    HttpClientHelper helper;
+    REQUIRE_THROWS_HR(helper.HandleGet(L"https://github.com", headers), APPINSTALLER_CLI_ERROR_RESTAPI_UNSUPPORTED_MIME_TYPE);
+}
diff --git a/src/AppInstallerCommonCore/Runtime.cpp b/src/AppInstallerCommonCore/Runtime.cpp
index 22c699ce31..1618776842 100644
--- a/src/AppInstallerCommonCore/Runtime.cpp
+++ b/src/AppInstallerCommonCore/Runtime.cpp
@@ -572,9 +572,11 @@ namespace AppInstaller::Runtime
 
     Utility::LocIndString GetUserAgent(std::string_view caller)
     {
+        auto escapedCaller = winrt::Windows::Foundation::Uri::EscapeComponent(Utility::ConvertToUTF16(caller));
+
         std::ostringstream strstr;
         strstr <<
-            caller <<
+            Utility::ConvertToUTF8(escapedCaller) <<
             " WindowsPackageManager/" << GetClientVersion() <<
             " DesktopAppInstaller/" << GetPackageVersion();
         return Utility::LocIndString{ strstr.str() };