disallow reserved characters

neicnordic · Jul 30, 2024 · c7134e0 · c7134e0
1 parent b9acf34
commit c7134e0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/sda/cmd/s3inbox/proxy.go b/sda/cmd/s3inbox/proxy.go
@@ -510,7 +510,7 @@ func formatUploadFilePath(filePath string) (string, error) {
 	outPath := strings.ReplaceAll(filePath, "\\", "/")
 
 	// [\x00-\x1F\x7F] is the control character set
-	re := regexp.MustCompile(`[\\:\*\?"<>\|\x00-\x1F\x7F]`)
+	re := regexp.MustCompile(`[\\<>"\|\x00-\x1F\x7F\!\*\'\(\)\;\:\@\&\=\+\$\,\?\%\#\[\]]`)
 
 	dissallowedChars := re.FindAllString(outPath, -1)
 	if dissallowedChars != nil {

diff --git a/sda/cmd/s3inbox/proxy_test.go b/sda/cmd/s3inbox/proxy_test.go
@@ -499,7 +499,7 @@ func (suite *ProxyTests) TestFormatUploadFilePath() {
 	assert.EqualError(suite.T(), err, "filepath contains mixed '\\' and '/' characters")
 
 	// no mixed "\" and "/" but not allowed
-	weirdPath = `dq\sw:*?"<>|\t\sdf.c4gh`
+	weirdPath = `dq\sw:*?"<>|\t\sdf!s'(a);w@4&f=+e$,g#[]d%.c4gh`
 	_, err = formatUploadFilePath(weirdPath)
-	assert.EqualError(suite.T(), err, "filepath contains disallowed characters: :, *, ?, \", <, >, |")
+	assert.EqualError(suite.T(), err, "filepath contains disallowed characters: :, *, ?, \", <, >, |, !, ', (, ), ;, @, &, =, +, $, ,, #, [, ], %")
 }