By zach harkey on

I just took a look in one of my client's "images" directory and cringed when I saw they have hundreds of image files with names like:

Green Bubble Glasses $12.50s & $16L (268).preview.jpg

They are using the image module to upload files. During development, I gave them my standard file naming speech (all lowercase, no spaces or special characters, etc.) mainly because in the past, names like the above have caused me nothing but grief.

Of course they could care less about my personal preferences. If the upload form will accept it, their work is done and it's on to the next R1d!€u£oU$ file name. So the only way I can control anything is to either rename all uploaded files, or not accept files with bad names.

At the moment I don't have direct evidence that any of these file names are causing problems, but I'm scared.

- Could names like the one above wreak havoc in ways that I might not be aware of?
- What exactly is and is not allowed in image module uploaded file names?
- Is this just not an issue?

Comments

robertdouglass’s picture

robertdouglass commented

If it is, make sure and file a report. Drupal tries to handle all strings as UTF-8 internally, and for URLS there is URL escaping for the special characters. If anything doesn't work, it is a major bug and needs to be corrected. You might want to test some worse case scenarios yourself, though, and beat your client to the punch.

- Robert Douglass

-----
Rate the value of this post: http://rate.affero.net/robertDouglass/
I recommend CivicSpace: www.civicspacelabs.org
My sites: www.hornroller.com, www.robshouse.net

dman’s picture

dman commented

I found this an issue of sorts.
Out of the box, image.module seemed to collapse on moving filenames around with spaces in them (Windows/Apache dev site BTW). My sourch was from misc directory imports, not file_upload so I don't know where the issue began.

This made me tweak a little to backslash the whitespace ... then begin to wonder about other vulnerabilities. Should I escape or encode or rename the non-alpha characters? Is there a chance that a silly name like img.jpg";rm%20-r%20.;x.jpg could cause an exploit - somewhere in the image toolkit calls maybe?

Good thing with open-source, we can go have a look. Just not me, not tonight.
Does PHP5 start 'tainting'? I remember what a shock and a delight it was when that happened to Perl.

.dan.

.dan. is the New Zealand Drupal Developer working on Government Web Standards