security - How to sanitize user created filenames for a networked application? -

-

i'm working on instant messaging app, users can receive files friends.

the names of files received set sender of file, , multiple files can sent possibility of subdirectories. example, 2 files sent might "1" , "sub/2" such downloaded results should "downloads/1" , "downloads/sub/2".

i'm worried security implications of this. right off top of head, 2 potentially dangerous filnames "../../../somethingnasty" or "~/somethingnasty" unix-like users. other potential issues cross mind filenames characters unsupported on target filesystem, seems harder , may better ignore?

i'm considering stripping received filenames ".." , "~" type of blacklist approach individually think of problem cases hardly seems recipe security. what's recommended way sanitize filenames ensure nothing sinister happens?

if makes difference, app running on c++ qt framework.

it's wiser replace ".." xxx , ~ yyy. way convert invalid path valid path. i.e. if user wants upload "../../../somethingnasty" - no problems, let him upload file , store in xxx/xxx/xxx/somethingnasty.

or better, can encode nonalphanumeric characters (except slashes) %xy xy hexidecimal code of character. way have %2e%2e/%2e%2e/%2e%2e/somethingnasty


Comments

Post a Comment

Popular posts from this blog

ASP.NET/SQL find the element ID and update database -

-
basically i've got update query runs when click submit button. i have asp:repeater in page layer inside this <asp:repeater id="dgbookings" runat="server" onitemdatabound="itemdb"> <itemtemplate> <div class="bookingscontent"> <div class="bookingdetails" id="<%# databinder.eval(container.dataitem, "booking_ref") %>"> <p class="infotext"><%# databinder.eval(container.dataitem, "adults") %> <asp:linkbutton onclick="editdetails" text="edit..." runat="server"></asp:linkbutton></p> <p class="infotext"><asp:linkbutton onclick="submitdetails" text="submit..." runat="server"></asp:linkbutton></p> </div> </div> </itemtemplate> <asp:repeater> and outputs ...
Read more

jquery - appear modal windows bottom -

-
i have modal windows in application, work fine <div id="modal" class="modal hide fade" tabindex="-1" role="dialog" aria-labelledby="mymodallabel" aria-hidden="true"> but when modal appears, appear top of windows, , want appear bottom the application joomla 3.0! , using template of meet gavern any idea? i found solution i modified de css in bootstrap .modal.fade { top:-25%; -webkit-transition:opacity .3s linear, bottom .3s ease-out; -moz-transition:opacity .3s linear, bottom .3s ease-out; -ms-transition:opacity .3s linear, bottom .3s ease-out; -o-transition:opacity .3s linear, bottom .3s ease-out; transition:opacity .3s linear, bottom .3s ease-out; }
Read more

c++ - Compiling static TagLib 1.6.3 libraries for Windows -

-
i having super hard time compiling , using taglib 1.6.3 in qt project. i've tried can think of. taglib claims supported through cmake i'm not having luck. furthermore, i'm confused kinds of files need qt libs! i've built *.a files, *.lib, , *.dll. understand far... believe since i'm working in windows *.lib want. no matter do, end "undefined references" taglib functions try use when try compile qt project. have tried mingw32, msys, visual studio 2008, , cross-compiling windows on linux. turning nothing. what makes less sense me if compile same taglib source qt on mac (g++ think?) works fine! somewhere in windows compilation procedures have going wrong. have been smacking face on desk 30 (on , off) hours trying figure out. since qt uses mingw must compile taglib same compiler? if compile *.lib's visual studio not compatible? are *.a libraries usable in windows? (assuming mingw) i'm still trying handle on c++ stuff, after reading coun...
Read more