Steps to Reproduce

1. Upload an attachment containing a character which needs to be encoded for inclusion in a URI query component, but not for a path component, e.g. colon or parentheses.
2. Make a request to /rest/api/content/[content-id]/child/attachment

Actual Results

The response field _links.download for the attachment contains the path to the file encoded using application/x-www-form-urlencoded. If used directly within a Connect add-on, query-string hash validation fails in Confluence.

Workaround

Decode the download path using application/x-www-form-urlencoded. Reencode it as a URI path.

Original Description

https://groups.google.com/forum/#!topic/atlassian-connect-dev/zhMT6ITI-Ok

I created an attachment with ':' in the filename and try to download to add-on server. URL from '/rest/api/content/{id}/child/attachment': /download/attachments/35946500/2016-04-04T06%3A17%3A40.842Z.png?version=1&modificationDate=1459750715126&api=v2

Error: Expecting claim 'qsh' to have value '14c07ff61801eb73010d9e7a8aa0182f41ec8334dc2ec8b78d627cf01a29997e' but instead it has the value '4dbb8612f7b20148bf4737618573310539004829d714de8869c9c2a94502fa2f'

If I replace '%3A' with ':' the call works (either work on local Confluence).