mirrors/git-annex
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

importfeed: Fix reversion that caused some '.' in filenames to be replaced with '_'

Browse source 
sanitizeFilePath was changed to sanitize leading '.', but ImportFeed was
running it on parts of the template. So eg the leading '.' in the extension
got sanitized.

Note the added case for sanitizeLeadingFilePathCharacter ('/':_)
-- this was added because, if the template is title/episode and the title
is not set, it would expand to "/episode". So this is another potential
security fix.
This commit is contained in:
Joey Hess 2020-08-05 11:35:00 -04:00
parent b4db85c265
commit 283d2f85d1
No known key found for this signature in database
GPG key ID: DB12DB0FF05F8F38
4 changed files with 29 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

23
Command/ImportFeed.hs
View file

@ -338,17 +338,18 @@ defaultTemplate = "${feedtitle}/${itemtitle}${extension}"
{- Generates a filename to use for a feed item by filling out the template.
- The filename may not be unique. -}
feedFile :: Utility.Format.Format -> ToDownload -> String -> FilePath
feedFile tmpl i extension = Utility.Format.format tmpl $
M.map sanitizeFilePath $ M.fromList $ extractFields i ++
[ ("extension", extension)
, extractField "itempubdate" [itempubdate]
, extractField "itempubyear" [itempubyear]
, extractField "itempubmonth" [itempubmonth]
, extractField "itempubday" [itempubday]
, extractField "itempubhour" [itempubhour]
, extractField "itempubminute" [itempubminute]
, extractField "itempubsecond" [itempubsecond]
]
feedFile tmpl i extension = sanitizeLeadingFilePathCharacter $
Utility.Format.format tmpl $
M.map sanitizeFilePathComponent $ M.fromList $ extractFields i ++
[ ("extension", extension)
, extractField "itempubdate" [itempubdate]
, extractField "itempubyear" [itempubyear]
, extractField "itempubmonth" [itempubmonth]
, extractField "itempubday" [itempubday]
, extractField "itempubhour" [itempubhour]
, extractField "itempubminute" [itempubminute]
, extractField "itempubsecond" [itempubsecond]
]
where
itm = item i