From aa1958c848ed30f293826c82f1b74c646c8a7eca Mon Sep 17 00:00:00 2001
From: Mikael Finstad <finstaden@gmail.com>
Date: Tue, 5 Dec 2023 13:22:23 +0800
Subject: [PATCH] change logic when sanitizing

- disallow slashes on windows
- check for file name ending with a space or a dot

closes #1790
---
 src/components/OutSegTemplateEditor.jsx |  2 +-
 src/util/outputNameTemplate.js          | 28 +++++++++++++++++++------
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/src/components/OutSegTemplateEditor.jsx b/src/components/OutSegTemplateEditor.jsx
index 9521a3c1..224e1add 100644
--- a/src/components/OutSegTemplateEditor.jsx
+++ b/src/components/OutSegTemplateEditor.jsx
@@ -132,7 +132,7 @@ const OutSegTemplateEditor = memo(({ outSegTemplate, setOutSegTemplate, generate
               ))}
             </div>
 
-            {error != null && <div style={{ marginBottom: '1em' }}><ErrorIcon color="var(--red9)" size={14} verticalAlign="baseline" /> {i18n.t('There is an error in the file name template:')} {error}</div>}
+            {error != null && <div style={{ marginBottom: '1em' }}><ErrorIcon color="var(--red9)" size={14} verticalAlign="baseline" /> {error}</div>}
 
             {isMissingExtension && (
               <div style={{ marginBottom: '1em' }}>
diff --git a/src/util/outputNameTemplate.js b/src/util/outputNameTemplate.js
index 933d91ba..ca12e9a5 100644
--- a/src/util/outputNameTemplate.js
+++ b/src/util/outputNameTemplate.js
@@ -17,14 +17,14 @@ function getOutSegError({ fileNames, filePath, outputDir, safeOutputFileName })
   // eslint-disable-next-line no-restricted-syntax
   for (const fileName of fileNames) {
     if (!filePath) {
-      error = 'No file path';
+      error = i18n.t('No file is loaded');
       break;
     }
 
     const invalidChars = new Set();
 
     // https://stackoverflow.com/questions/1976007/what-characters-are-forbidden-in-windows-and-linux-directory-names
-    // note that we allow path separators!
+    // note that we allow path separators in some cases (see below)
     if (isWindows) {
       ['<', '>', ':', '"', '|', '?', '*'].forEach((char) => invalidChars.add(char));
     } else if (isMac) {
@@ -32,12 +32,22 @@ function getOutSegError({ fileNames, filePath, outputDir, safeOutputFileName })
       [':'].forEach((char) => invalidChars.add(char));
     }
 
-    if (safeOutputFileName) invalidChars.add(pathSep);
+    if (safeOutputFileName) {
+      if (isWindows) {
+        // Only when sanitize is "off" shall we allow slashes (you're on your own)
+        invalidChars.add('/');
+        invalidChars.add('\\');
+      } else {
+        invalidChars.add(pathSep);
+      }
+    }
 
-    const outPath = pathNormalize(pathJoin(outputDir, fileName));
-    const sameAsInputPath = outPath === pathNormalize(filePath);
+    const inPathNormalized = pathNormalize(filePath);
+    const outPathNormalized = pathNormalize(pathJoin(outputDir, fileName));
+    const sameAsInputPath = outPathNormalized === inPathNormalized;
     const windowsMaxPathLength = 259;
     const shouldCheckPathLength = isWindows || isDev;
+    const shouldCheckFileEnd = isWindows || isDev;
 
     if (fileName.length === 0) {
       error = i18n.t('At least one resulting file name has no length');
@@ -51,7 +61,13 @@ function getOutSegError({ fileNames, filePath, outputDir, safeOutputFileName })
       error = i18n.t('At least one resulting file name is the same as the input path');
       break;
     }
-    if (shouldCheckPathLength && outPath.length >= windowsMaxPathLength) {
+    if (shouldCheckFileEnd && /[\s.]$/.test(fileName)) {
+      // Filenames cannot end in a space or dot on windows
+      // https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions
+      error = i18n.t('At least one resulting file name ends with a whitespace character or a dot, which is not allowed.');
+      break;
+    }
+    if (shouldCheckPathLength && outPathNormalized.length >= windowsMaxPathLength) {
       error = i18n.t('At least one resulting file will have a too long path');
       break;
     }