From: Luis Parravicini <lparravi@...>
Date: 2007-09-13T02:50:09+09:00
Subject: Re: secure file writing (escaping characters from the file name)

On 9/12/07, Constantin Gavrilescu <costi@apluscompuservices.com> wrote:
> I have a cgi script that writes files on the filesystem. The files are
> provided by the users. I need to save them with (almost) the same name
> as the user requests. What characters I need to escape?
>
> This is on linux. Right now the file: "Mick Jagger / Chris Jagger -
> Racketeer Blues" does not get saved because of the "/" character. I
> don't escape any characters now. I want to keep as many of the original
> characters in the file name as I can. For the characters that cannot be
> escaped, I suppose I need a translation table... to figure out what was
> the original filename.
>
> Any pointers? More importantly about escaping special characters, and
> avoiding directory traversal.

Hi Constantin,

Maybe instead of escaping/removing any character in the filename you
can store the file with a unique name and have an index with the user
supplied filename and the name of the file in the file system?


-- 
Luis Parravicini
http://ktulu.com.ar/blog/