in reply to Re^4: Getting information about a remote file via SSH: how to escape the filename
in thread Getting information about a remote file via SSH: how to escape the filename
How can you discern a valid filename from a malicious one in a generic way?
The OP has pointed out in his case, malicious file names would be unlikely,
I found that most of the time there was quite the possibility to narrow down the range of allowed characters to minimum of less than 70, excluding most interpunctuation characters.and shell redirects and pipes, control characters and whitespace.
But it is very good you mentioned it, as in a current project I find myself in a less fortunate position where I have to grok file names coming in through user input:
the users are real users and the file system a windows ntfs in my particular case.
Suggestions on how to stay safe are very welcome.
Cheers, Sören
(hooked on the Perl Programming language)