New sanitizer

[arvidn]

introduce options for filename sanitization. As a field on add_torrent_params it's saved and restored with resume data, to preserve backwards compatibility.

[github-actions]

Bencher Report

Branch	new-sanitizer
Testbed	ubuntu-24.04

Click to view all benchmark results

Benchmark	Latency	Benchmark Result nanoseconds (ns) (Result Δ%)	Upper Boundary nanoseconds (ns) (Limit %)
base-v1.torrent	📈 view plot 🚷 view threshold	47,843.73 ns (-20.57%) Baseline: 60,237.27 ns	94,321.46 ns (50.72%)
base-v2.torrent	📈 view plot 🚷 view threshold	57,264.33 ns (-41.09%) Baseline: 97,207.23 ns	170,205.64 ns (33.64%)
dh_compute_secret	📈 view plot 🚷 view threshold	38,836.22 ns (-44.16%) Baseline: 69,548.76 ns	187,390.00 ns (20.72%)
dh_handshake	📈 view plot 🚷 view threshold	76,719.89 ns (-44.56%) Baseline: 138,391.08 ns	369,990.63 ns (20.74%)
dh_key_exchange	📈 view plot 🚷 view threshold	38,467.67 ns (-43.30%) Baseline: 67,847.55 ns	178,323.87 ns (21.57%)
ip_filter: access, hit	📈 view plot 🚷 view threshold	65.04 ns (-0.62%) Baseline: 65.44 ns	82.21 ns (79.11%)
ip_filter: access, miss	📈 view plot 🚷 view threshold	64.60 ns (-0.19%) Baseline: 64.72 ns	80.32 ns (80.43%)
many-pad-files.torrent	📈 view plot 🚷 view threshold	912,197.99 ns (-46.47%) Baseline: 1,704,089.24 ns	7,946,741.92 ns (11.48%)
merkle: compute root	📈 view plot 🚷 view threshold	196,547.87 ns (-16.45%) Baseline: 235,250.53 ns	511,241.04 ns (38.45%)
merkle: create proof	📈 view plot 🚷 view threshold	131.08 ns (+4.64%) Baseline: 125.27 ns	156.68 ns (83.66%)
merkle: validate proof	📈 view plot 🚷 view threshold	2,038.38 ns (-23.04%) Baseline: 2,648.52 ns	5,636.64 ns (36.16%)
piece picker: add/remove near-seed	📈 view plot 🚷 view threshold	137,733.36 ns (-24.25%) Baseline: 181,829.76 ns	326,491.58 ns (42.19%)
piece picker: add/remove seed	📈 view plot 🚷 view threshold	29.90 ns (+3.20%) Baseline: 28.97 ns	37.42 ns (79.90%)
piece picker: break one seed	📈 view plot 🚷 view threshold	125,425.38 ns (+2.94%) Baseline: 121,840.27 ns	165,089.41 ns (75.97%)
piece picker: get availability	📈 view plot 🚷 view threshold	21,153.92 ns (+27.57%) Baseline: 16,582.09 ns	23,393.98 ns (90.42%)
piece picker: mark as downloading, high index	📈 view plot 🚷 view threshold	98.86 ns (+3.04%) Baseline: 95.95 ns	118.73 ns (83.27%)
piece picker: mark as downloading, low index	📈 view plot 🚷 view threshold	1,764.14 ns (+8.47%) Baseline: 1,626.35 ns	2,212.26 ns (79.74%)
piece picker: pick pieces, after dirty	📈 view plot 🚷 view threshold	1,023,069.03 ns (+4.77%) Baseline: 976,470.20 ns	1,267,500.41 ns (80.72%)
piece picker: pick pieces, clean	📈 view plot 🚷 view threshold	45.64 ns (+3.42%) Baseline: 44.13 ns	52.95 ns (86.19%)
piece picker: pick pieces, dense peer	📈 view plot 🚷 view threshold	46.16 ns (+2.31%) Baseline: 45.12 ns	54.27 ns (85.06%)
piece picker: pick pieces, sparse peer	📈 view plot 🚷 view threshold	281,568.11 ns (-11.37%) Baseline: 317,686.35 ns	653,264.06 ns (43.10%)
piece picker: piece priorities	📈 view plot 🚷 view threshold	19,286.47 ns (+4.16%) Baseline: 18,516.80 ns	23,004.66 ns (83.84%)
piece picker: refcount bitfield, 1 bit set	📈 view plot 🚷 view threshold	5,014.93 ns (-93.26%) Baseline: 74,460.48 ns	291,728.59 ns (1.72%)
piece picker: refcount bitfield, 10 bits set	📈 view plot 🚷 view threshold	5,156.77 ns (-93.12%) Baseline: 74,984.04 ns	292,980.57 ns (1.76%)
piece picker: refcount bitfield, 200 bits set	📈 view plot 🚷 view threshold	7,244.59 ns (-90.63%) Baseline: 77,288.52 ns	297,028.27 ns (2.44%)
piece picker: refcount bitfield, 49 bits set	📈 view plot 🚷 view threshold	6,108.84 ns (-91.89%) Baseline: 75,321.80 ns	292,431.83 ns (2.09%)
piece picker: refcount bitfield, 50 bits set	📈 view plot 🚷 view threshold	6,146.10 ns (-91.84%) Baseline: 75,347.06 ns	292,567.24 ns (2.10%)
piece picker: refcount bitfield, 5000 bits set	📈 view plot 🚷 view threshold	41,717.22 ns (-57.41%) Baseline: 97,954.84 ns	296,058.56 ns (14.09%)
rc4_encrypt	📈 view plot 🚷 view threshold	30,322.29 ns (-6.47%) Baseline: 32,419.11 ns	47,447.68 ns (63.91%)

🐰 View full continuous benchmarking report in Bencher

[Copilot]

🟡 Changes recommended

sanitize_flags deserialization currently casts signed resume-data integers directly to uint32_t without range validation, allowing negative/out-of-range values to wrap into unintended flag sets.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR introduces versioned, configurable filename/path sanitization rules via a new path_sanitize_flags_t bitfield, threads the selected ruleset through torrent parsing and lifetime, and persists it in resume data to avoid silent filename changes across libtorrent upgrades.

Changes:

• Add path_sanitize_flags_t (+ documented historical rulesets and default_flags) and expose it via load_torrent_limits::sanitize_flags and add_torrent_params::sanitize_flags.
• Persist/restore sanitize_flags in resume data and pin it to torrents (including metadata-on-arrival cases like magnet links).
• Add/extend unit tests and fuzz coverage for sanitization behavior and resume-data/version fallback logic.

File summaries

File	Description
test/test_torrent_info.cpp	Updates sanitizer helper/tests to be flag-driven and adds coverage for new rules.
test/test_sanitizer.cpp	New test exercising combinations of sanitization flags against a purpose-built torrent.
test/test_resume.cpp	Adds tests for resume-data sanitize_flags roundtrips and version-based fallback behavior.
test/Jamfile	Adds test_sanitizer to test runs/aliases.
src/write_resume_data.cpp	Writes sanitize_flags into resume data.
src/torrent.cpp	Pins sanitize_flags on torrents and reuses it when parsing metadata later.
src/torrent_info.cpp	Implements flag-controlled sanitization rules (invalid chars, formatting chars, DOS reserved names, unicode length counting, trimming).
src/read_resume_data.cpp	Reads sanitize_flags (or infers it from writer version) and passes it into torrent parsing.
src/load_torrent.cpp	Stamps the parsing ruleset onto returned add_torrent_params.
Makefile	Installs new public header and adds test + test torrent to build lists.
include/libtorrent/torrent_info.hpp	Extends load_torrent_limits and updates aux::sanitize_path_element() signature to accept limits (incl. sanitize flags).
include/libtorrent/path_sanitize_flags.hpp	New public header defining sanitization flags and versioned rulesets.
include/libtorrent/libtorrent.hpp	Exposes the new public header via the umbrella include.
include/libtorrent/aux_/torrent.hpp	Stores pinned sanitize_flags in torrent internal state and exposes an accessor.
include/libtorrent/add_torrent_params.hpp	Adds add_torrent_params::sanitize_flags with documentation about pinning/compatibility.
fuzzers/src/torrent_info.cpp	Exercises multiple real-world sanitize rulesets in the fuzzer.
fuzzers/src/sanitize_path.cpp	Fuzzes sanitize_path_element() under several rulesets.
docs/upgrade_to_2.2.rst	Documents configurable sanitization and the compatibility behavior.
docs/hunspell/libtorrent.dic	Adds new sanitizer-related terms to the dictionary.
CMakeLists.txt	Installs the new public header.
ChangeLog	Notes versioned path-sanitization feature.
bindings/python/tests/torrent_info_test.py	Adds Python test coverage for load_torrent_limits.sanitize_flags.
bindings/python/src/torrent_info.cpp	Parses sanitize_flags from Python load_torrent_limits dict.
bindings/python/src/session.cpp	Exposes add_torrent_params.sanitize_flags and path_sanitize_flags constants to Python.
bindings/python/src/converters.cpp	Adds Python converters for path_sanitize_flags_t.
bindings/python/libtorrent/init.pyi	Updates stubs for sanitize_flags and introduces path_sanitize_flags constants.

Review details

• Files reviewed: 26/27 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.