Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-08-29 10:08:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: strip control characters from sanitized filenames (#9151)

Browse Source 
Prevent tab, newline, and other ASCII control characters from appearing
in S3 object keys generated from user-provided upload filenames.

Fixes #9127

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Karthikeyan Ganesh
2026-07-28 17:52:46 +05:30
committed by GitHub
parent 6a061acc69
commit 49c4da6d4b
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/api/plane/utils/path_validator.py
View File

@@ -15,8 +15,8 @@ def sanitize_filename(filename):
"""
Sanitize a filename to prevent path traversal attacks.
Strips directory components, path traversal sequences, and null bytes
from user-supplied filenames used in upload paths and S3 object keys.
Strips directory components, path traversal sequences, and control
characters from user-supplied filenames used in upload paths and S3 object keys.
Returns None for empty/missing input so callers can still validate
that a filename was provided.
@@ -24,8 +24,8 @@ def sanitize_filename(filename):
if not filename or not isinstance(filename, str):
return None
# Strip null bytes
filename = filename.replace("\x00", "")
# Strip ASCII control characters (0-31 and 127), including null bytes
filename = "".join(char for char in filename if not (ord(char) < 32 or ord(char) == 127))
# Normalize backslashes so os.path.basename handles Windows-style paths on POSIX
filename = filename.replace("\\", "/")