>
> On Fri, Sep 02, 2016 at 04:43:53PM +0100, Frediano Ziglio wrote:
> > Check if filename contains invalid characters.
>
> Can you be more specific here about "invalid"? My guess is that these
> are characters which are invalid in an NTFS filesystem.
>
Some characters are reserved and should not be used in Windows
independently by the file system used.
> > Also this avoid to use paths in the filename which could lead to some
> > nasty hacks (like names like "..\hack.txt").
> >
> > Signed-off-by: Frediano Ziglio <fziglio@xxxxxxxxxx>
> > ---
> > vdagent/file_xfer.cpp | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/vdagent/file_xfer.cpp b/vdagent/file_xfer.cpp
> > index 0e90ebe..2072277 100644
> > --- a/vdagent/file_xfer.cpp
> > +++ b/vdagent/file_xfer.cpp
> > @@ -65,6 +65,10 @@ void FileXfer::handle_start(VDAgentFileXferStartMessage*
> > start,
> > return;
> > }
> > vd_printf("%u %s (%" PRIu64 ")", start->id, file_name, file_size);
> > + if (strcspn(file_name, "<>:\"/\\|?*") != strlen(file_name)) {
>
> You could add ^ as well which is invalid on FAT. Apparently we could
> check for trailing space or colon too.
>
Colon is in the list. It's used to separate filename from stream name and can
be used to create hidden streams. Also is used for drive separator (A:) or device names (NUL:).
/ and \ are reserved for components (directory, filename, drive, share, server) separators.
* and ? are globs (globs on Windows are supported by different APIs too).
Other are reserved for shell usage (<, > and |).
Space at the end are just misleading but supported.
^, & and ; are (strangely) accepted (at least by NTFS).
>
>
> Christophe
>
The more worrying are the path separators.
Frediano
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel