-
Notifications
You must be signed in to change notification settings - Fork 80
Open
Description
The regex for dataset (^[^\\/\\\\:*?\"<>|]+(\\.[^\\/\\\\:*?\"<>|]+)*) is broken.
The inclusion of an allowed dot (.) in the second character class implies that you're allowing dots after the first character. However, the first character class does not actually exclude a dot as the starting character.
Also, the pattern should end in $.
The current regex will match on
safe_filename.txt; rm -rf /
I think the new pattern should be: ^[^\\/\\\\:*?\"<>|]+$ or ^[^\\/\\\\:*?\"<>|.]+(\.[^\\/\\\\:*?\"<>|.]+)*$ depending on what you're going for with that dot. The second one would prevent hidden files on *nix (.sigmfignore) and stuff like bing..bang.txt.
It's probably worth forbidding semicolons as well.
Metadata
Metadata
Assignees
Labels
No labels