expectocode / telegram-export

Export Telegram chat data and history
Mozilla Public License 2.0
460 stars 95 forks source link

Unsafe chat names when downloading media #100

Open gumblex opened 5 years ago

gumblex commented 5 years ago

Some chat names, eg. "a/b/c", when using with MediaFilenameFmt = usermedia/{name}-{context_id}/{type}-{filename} can create folders like "usermedia/a/b/c--123456/document-filename.123.txt"

This is not intended and unsafe (like a/../../b), and also have problems with other filesystem filename restrictions. Please really sanitize the chat name, sender name and file names. For example, replace " * / : < > ? \ | characters with _.

Lonami commented 5 years ago

99 also noticed this issue, although the PR is unrelated.

gumblex commented 5 years ago

99 only fixes filename, not chat name and sender name