Description

Some plain files names in Windows are forbidden. I'm not sure if moin handle errors correctly if one of these names is used.

Here is relevant spec, copied from Naming a file:

• Do not use the following reserved device names for the name of a file: CON, PRN, AUX, NUL, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LPT8, and LPT9. Also avoid these names followed by an extension, for example, NUL.tx7.

Details

Any version.

Discussion

Confirmed that MoinMoin does not handle these names gracefully when run on a Windows server. I Did not try all names or all possible variations, but here's what I found:

• All the basic patterns fail: CON  PRN  AUX  NUL  COMx, LPTx

• The names are not case-sensitive
• Although DOS/Windows syntax allows these to be followed by a colon, these forms don't cause a problem since moin appears to escape the colon as (3a)

• Only single-digit numbers after COM & LPT are an issue

• Adding an extension onto these special names seemed to remove the problem. Also, appending a "." (the "null" extension) did not cause a crash.

Here's the dump from one of the crashes: nuL_page.html

-- SteveDavison 2007-08-20 02:05:45

Well, the main question is what to do about this:

• disallow those pagenames
  • either means disallowing them on all platforms (just for the sake of being able to transfer the data_dir to win32 systems)
  • or only disallow if platform == win32
• quote those names using (XXXXXX) hex encoding

Plan

Someone on windows should verify that moin handle the forbidden names correctly. Not handled in 1.5.8 --Someone on Windows

• Priority:
• Assigned to:
• Status:

CategoryMoinMoinBug