Sanitize filename with user input

If you have to build a filename (e.g. for use in downloads) that contains user input, keep in mind that malicious input might come from users and could lead to security problems.

Instead of blacklisting characters such as / , . \ ´ etc. better go for a stricter approach and use a whitelist such as:

def sanitize_filename(filename)
  filename.gsub(/[^0-9A-z.\-]/, '_')
end

If you need to have German Umlauts you can use /[^\w\-]/. This, however, will only work if the locale is set to German.
You might also want to transliterate Umlauts before using gsub, e.g.

I18n.transliterate('Übersetzung')
=> 'Uebersetzung'

with the following Hash in <locale>.yml:

i18n:
  transliterate:
    rule:
      Ä: Ae
      Ö: Oe
      Ü: Ue
      ä: ae
      ö: oe
      ü: ue

This will escape all characters except dashes, numbers and alphanumeric characters to underscores:

sanitize_filename "this -> !#+ <- gets sanitized, honey!"
=> "this_-_______-_gets_sanitized__honey_"

Thomas Eisenbarth

makandra.de

Say thanks4

Last edit

2020-02-09

Daniel Straßner

Keywords

safe, secure, string

License

Source code in this card is licensed under the MIT License.

Sanitize user-generated filenames and only send files inside a given directory

If in your application your users pass along params that result in filenames, like invoices/generated?number=123. This could be your (very careless) controller method:

def generated
  send_file File.join(Rails.root, 'shared', 'invoices'...

Never use YAML.load with user input

You can get YAML.load to instantiate any Ruby object by embedding the desired class name into the YAML code. E.g. the following will create a new User object and set @email and @password to the given values:

--- !ruby/object:User

...

How to add a user with all privileges to MariaDB

Add a user without password (recommended)

Replace newuser with your desired username:

mysql -uroot -p
CREATE USER 'newuser'@'localhost' IDENTIFIED BY '';
GRANT ALL PRIVILEGES ON * . * TO 'newuser'@'localhost';
FLUSH PRIVILEGES;
exit;
``...

Posted by Thomas Eisenbarth to makandra dev (2011-06-28 13:21)

Sanitize filename with user input

Related cards:

Add a user without password (recommended)

Percent Notation

Modifier