decentraland / social-service-ea / 28097019696

90%

main: 90%

Pull #420

github

fix: make multipart filename sanitizer robust to separators after a newline

sanitizeFilename used a `/^.*[\\/]/` replace, but `.` does not match newlines,
so a filename such as `evil\n../../x.png` found no separator before the newline
and was returned unsanitized — leaving path components intact. Split on the path
separators and take the last segment instead, which strips directory components
regardless of embedded newlines.

Export the helper and add direct unit tests covering plain, POSIX, Windows, and
newline-hidden-separator filenames.

2242 of 2642 branches covered (84.86%)

Branch coverage included in aggregate %.

98 of 103 new or added lines in 55 files covered. (95.15%)

5512 of 6004 relevant lines covered (91.81%)

73.13 hits per line