Merge pull request #287 from Xpirix/backslashes_handling

Add validation for backslashes in ZIP file names

Author: Xpirix

qgis-app/plugins/tests/test_validator.py

@@ -333,3 +333,30 @@ def test_plugin_with_single_parent(self):
         )
         multiple_parent_folders = self._get_value_by_attribute('multiple_parent_folders', result)
         self.assertIsNone(multiple_parent_folders)
+
+
+class TestPathWithBackslashValidator(TestCase):
+    def setUp(self) -> None:
+        path_with_backslash = os.path.join(TESTFILE_DIR, "path_with_backslash.zip_")
+        self.path_with_backslash = open(path_with_backslash, "rb")
+
+    def tearDown(self):
+        self.path_with_backslash.close()
+
+    def test_path_with_backslash(self):
+        """
+        The path_with_backslash.zip contains file with
+        path with backslash.
+        """
+        self.assertRaises(
+            ValidationError,
+            validator,
+            InMemoryUploadedFile(
+                self.path_with_backslash,
+                field_name="tempfile",
+                name="testfile.zip",
+                content_type="application/zip",
+                size=39889,
+                charset="utf8",
+            ),
+        )

qgis-app/plugins/tests/testfiles/path_with_backslash.zip_

@@ -298,6 +298,29 @@ def validator(package, is_new: bool = False):
     except:
         pass
 
+    # Check if the zip namelist contains backslashes or drive letters, which is not allowed.
+    for name in namelist:
+        if "\\" in name:
+            raise ValidationError(
+                _(
+                    "Your archive does not conform to the ZIP specification, "
+                    "it cannot contain backslashes in file names (found '{}'). "
+                    "Please try again with a valid ZIP file (or use a different archiving tool).".format(
+                        name
+                    )
+                )
+            )
+        if re.match(r"^[A-Za-z]:", name):
+            raise ValidationError(
+                _(
+                    "Your archive does not conform to the ZIP specification, "
+                    "it cannot contain drive letters in file names (found '{}'). "
+                    "Please try again with a valid ZIP file (or use a different archiving tool).".format(
+                        name
+                    )
+                )
+            )
+
     # Checks that package_name  exists
     try:
         package_name = namelist[0][: namelist[0].index("/")]