Stricter sanitization rules for download filenames

Fixes #212
2026-01-24 00:03:14 -05:00 · 2021-09-06 12:58:48 +00:00
parent da8a485087
commit 60a126024c
1 changed files with 3 additions and 2 deletions
--- a/src/plugin/downloader.cr
+++ b/src/plugin/downloader.cr
@@ -24,8 +24,9 @@ class Plugin
    end

    private def process_filename(str)
-      return "_" if str == ".."
-      str.gsub "/", "_"
+      str
+        .gsub(/[\/\s\.\177\000-\031]/, "_")
+        .gsub(/__+/, "_")
    end

    private def download(job : Queue::Job)