Prevent directory traversals by replacing dots and slashes.

man/man7/telodendria-changelog.7

@@ -68,6 +68,10 @@ would occur in some edge cases.
 .It
 Fixed an "off-by-one" error in the HTTP server request
 parser that prevented GET parameters from being parsed.
+.It
+Fixed the database file name generator to prevent directory
+traversal attacks by replacing characters with special meaning
+with safer characters.
 .El
 .Pp
 Misc.:

src/Db.c

@@ -208,10 +208,30 @@ DbFileName(Db * db, Array * args)
     for (i = 0; i < ArraySize(args); i++)
     {
         char *tmp, *tmp2;
+        char *arg = UtilStringDuplicate(ArrayGet(args, i));
 
-        tmp = UtilStringConcat(str, ArrayGet(args, i));
+        /* Sanitize name to prevent directory traversal attacks */
-        tmp2 = UtilStringConcat(tmp, (i < ArraySize(args) - 1) ? "/" : ".json");
+        while (*arg)
+        {
+            switch (*arg)
+            {
+                case '/':
+                    *arg = '_';
+                    break;
+                case '.':
+                    *arg = '-';
+                    break;
+                default:
+                    break;
+            }
+            arg++;
+        }
 
+        tmp = UtilStringConcat(str, arg);
+        tmp2 = UtilStringConcat(tmp,
+            (i < ArraySize(args) - 1) ? "/" : ".json");
+
+        Free(arg);
         Free(str);
         Free(tmp);