Skip to content
This repository has been archived by the owner on Oct 23, 2019. It is now read-only.
This repository has been archived by the owner on Oct 23, 2019. It is now read-only.

Unsafe chat names when downloading media #100

Open
gumblex opened this issue Dec 21, 2018 · 2 comments
Open

Unsafe chat names when downloading media #100

gumblex opened this issue Dec 21, 2018 · 2 comments

Comments

@gumblex
Copy link

gumblex commented Dec 21, 2018

Some chat names, eg. "a/b/c", when using with
MediaFilenameFmt = usermedia/{name}-{context_id}/{type}-{filename}
can create folders like "usermedia/a/b/c--123456/document-filename.123.txt"

This is not intended and unsafe (like a/../../b), and also have problems with other filesystem filename restrictions. Please really sanitize the chat name, sender name and file names. For example, replace " * / : < > ? \ | characters with _.

@Lonami
Copy link
Collaborator

Lonami commented Dec 21, 2018

#99 also noticed this issue, although the PR is unrelated.

@gumblex
Copy link
Author

gumblex commented Dec 21, 2018

#99 only fixes filename, not chat name and sender name

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants