# Refuse image and strategy ids that could name a path outside the app's folder · dara/icarus

[View on GitCafe](https://git.cafe/dara/icarus/commit/0ccfa303d4e98d6f87dd91c37e1e29e15fea8464)

Repository: [dara/icarus](https://git.cafe/dara/icarus)

Visibility: public

Requested revision: 0ccfa303d4e98d6f87dd91c37e1e29e15fea8464

Requested commit: 0ccfa303d4e98d6f87dd91c37e1e29e15fea8464

Commit: 0ccfa303d4e98d6f87dd91c37e1e29e15fea8464

Tree: d326a5946038ac70531d5856b7de585b6cd8a77d

Author: Dara Adedeji

Committer: Dara Adedeji

## Message

```
Refuse image and strategy ids that could name a path outside the app's folder

The desktop app saves a cloud strategy's images as
<strategy publicId>/<image publicId><extension>. Nothing checked either id,
and completeUpload stored whatever extension the caller sent, so someone
sharing a strategy could make every member's app save a .bat into the
Windows Startup folder during the background offline copy.

The server now refuses strategy and image ids with a separator, drive colon,
control character or "..", keeps a finished upload's extension to the image
type that was uploaded, and never hands out a download URL for a row that
isn't a safe image file name, whichever path wrote it. Every id a shipped
build makes is a UUID or a copy id built from one, so none is refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

```

## Parents

- [e785cd1dde0e49a00bbbfda0e45d48ce504a1514](https://git.cafe/dara/icarus/commit/e785cd1dde0e49a00bbbfda0e45d48ce504a1514?format=markdown)

[Source at this commit](https://git.cafe/dara/icarus/tree/0ccfa303d4e98d6f87dd91c37e1e29e15fea8464?format=markdown)