filter special characters from incoming FT filenames

[zoff99]

filter '/' and '\' and '..' from incoming filename

toxic/src/chat.c

Line 622 in a86884c

snprintf(file_path, file_path_buf_size, "%s%s", user_settings->download_path, filename);

toxic/src/chat.c

Line 622 in a86884c

snprintf(file_path, file_path_buf_size, "%s%s", user_settings->download_path, filename);

[JFreegman]

What's wrong with ..? Or do you just mean .. without any other characters?

[zoff99]

because when the filename is
'/../../../../../../../../../../../../home/jfreegman/.bashrc'
then not matter what directory you prefix it with, it may write a nice .bashrc in your homedir with some sudo commands in it, if you don't have a .bashrc yet

[JFreegman]

Ok, that problem is solved by not allowing the / character.