whitelist all allowed characters in filenames, see #75

rlidwka · Jun 17, 2014 · 88f3944 · 88f3944
1 parent 2052411
commit 88f3944
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/lib/utils.js b/lib/utils.js
@@ -8,9 +8,10 @@ module.exports.validate_name = function(name) {
 	if (typeof(name) !== 'string') return false
 	name = name.toLowerCase()
 	if (
+		// all URL-safe characters and "@" for issue #75
+		!name.match(/^[-a-zA-Z0-9_.!~*'()@]+$/) ||
 		name.charAt(0) === '.' || // ".bin", etc.
 		name.charAt(0) === '-' || // "-" is reserved by couchdb
-		name.match(/[\\\/\s\+%:]/) ||
 		name === 'node_modules' ||
 		name === '__proto__' ||
 		name === 'package.json' ||