is_valid_filename: block characters that can cause trouble

Block characters which, while valid in filenames, sometimes cause
trouble; in particular block - at the beginning of a pathname
component, and block the following character set anywhere in the
filename:

	! " $ & ' * : ; < > ? \ ` |

(: is unclear to me... presumably because of *doze users?)

Suggested-by: Jean Delvare <jdelvare@suse.de>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>

2 files changed, 16 insertions, 4 deletions

diff --git a/korgupload b/korgupload
index b41ff8a..30e5e12 100755
--- a/korgupload
+++ b/korgupload
@@ -193,8 +193,14 @@ sub is_valid_filename($)
     return 0 if ($f !~ m:^/:);	# Reject relative paths
     return 0 if ($f =~ m:/$:);	# Reject paths ending in /
     return 0 if ($f =~ m://:);	# Reject double slashes
-    return 0 if ($f =~ m:/\.:);	# Reject any filename component starting with dot,
-    				# including . and ..
+    
+    # Reject filename components starting with dot or dash, covers . and ..
+    return 0 if ($f =~ m:/[\.\-]:);
+
+    # Reject undesirable filename characters anywhere in the name.
+    # This isn't inherently security-critical, and could be tuned if
+    # users need it...
+    return 0 if ($f =~ m:[\!\"\$\&\'\*\:\;\<\>\?\\\`\|]:);
 
     # Make sure we can create a filename after adding .bz2 or similar.
     # We can't use the obvious regexp here, because regexps operate on
diff --git a/kup b/kup
index b0c1b5c..c3d9493 100755
--- a/kup
+++ b/kup
@@ -89,8 +89,14 @@ sub is_valid_filename($)
     return 0 if ($f !~ m:^/:);	# Reject relative paths
     return 0 if ($f =~ m:/$:);	# Reject paths ending in /
     return 0 if ($f =~ m://:);	# Reject double slashes
-    return 0 if ($f =~ m:/\.:);	# Reject any filename component starting with dot,
-    				# including . and ..
+
+    # Reject filename components starting with dot or dash, covers . and ..
+    return 0 if ($f =~ m:/[\.\-]:);
+
+    # Reject undesirable filename characters anywhere in the name.
+    # This isn't inherently security-critical, and could be tuned if
+    # users need it...
+    return 0 if ($f =~ m:[\!\"\$\&\'\*\:\;\<\>\?\\\`\|]:);
 
     # Make sure we can create a filename after adding .bz2 or similar.
     # We can't use the obvious regexp here, because regexps operate on