[PATCH 2/4] testbot/web: Reject filenames that are not valid Windows filenames.

[Francois Gouget]

IsValidFileName() verifies that the filename is valid on both Windows
and Unix. This is necessary to ensure we will be able to upload the file
to the build and/or test VMs.
IsValidFileName() is defined in the Utils.pm module so it can be reused
where necessary.

Signed-off-by: Francois Gouget <fgouget at codeweavers.com>
---
 testbot/lib/WineTestBot/Utils.pm | 25 ++++++++++++++++++++++++-
 testbot/web/Submit.pl            |  4 ++--
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/testbot/lib/WineTestBot/Utils.pm b/testbot/lib/WineTestBot/Utils.pm
index 8b0bfeb0c..962e6ff67 100644
--- a/testbot/lib/WineTestBot/Utils.pm
+++ b/testbot/lib/WineTestBot/Utils.pm
@@ -28,7 +28,7 @@ WineTestBot::Utils - Utility functions
 use Exporter 'import';
 our @EXPORT = qw(MakeSecureURL SecureConnection GenerateRandomString
                  OpenNewFile CreateNewFile CreateNewLink CreateNewDir
-                 DurationToString BuildEMailRecipient);
+                 DurationToString BuildEMailRecipient IsValidFileName);
 
 use Fcntl;
 
@@ -173,4 +173,27 @@ sub CreateNewDir($$)
   }
 }
 
+
+#
+# Shell helpers
+#
+
+=pod
+=over 12
+
+=item C<IsValidFileName()>
+
+Returns true if the filename is valid on Unix and Windows systems.
+
+This also ensures this is not a trick filename such as '../important/file'.
+
+=back
+=cut
+
+sub IsValidFileName($)
+{
+  my ($FileName) = @_;
+  return $FileName !~ m~[<>:"/\\|?*]~;
+}
+
 1;
diff --git a/testbot/web/Submit.pl b/testbot/web/Submit.pl
index c16b99f1e..afebc722b 100644
--- a/testbot/web/Submit.pl
+++ b/testbot/web/Submit.pl
@@ -514,10 +514,10 @@ sub ValidateAndGetFileName($$)
     $self->{ErrMessage} = "You must provide a file to test";
     return undef;
   }
-  if ($FileName =~ m=[/\\]=)
+  if (!IsValidFileName($FileName))
   {
     $self->{ErrField} = $FieldName;
-    $self->{ErrMessage} = "The filename is invalid";
+    $self->{ErrMessage} = "The filename contains invalid characters";
     return undef;
   }
   my $PropertyDescriptor = CreateSteps()->GetPropertyDescriptorByName("FileName");
-- 
2.17.1