my $filename= $param =~ m#^(\w[-.\w]*)\z#
or die "Invalid file name ($param).\n";
####
my $filepath= $param =~ m#^((?:/?[.\w][-.\w]*)+)\z#
or die "Invalid file path ($param).\n";
####
#!/usr/bin/perl -w
use strict;
use File::Spec::Functions qw( splitpath splitdir catdir catpath );
for my $path ( @ARGV ) {
eval {
warn "($path) => (", untaintPath( $path ), ")\n";
1;
} or
warn "$@\n";
}
exit( 0 );
sub untaintPath {
my( $param )= @_;
my( $vol, $dirs, $file )= splitpath( $param );
## my( $clean )= $file =~ m#^(\w[-.\w]*)\z#
my( $clean )= $file =~ m#^(\w[-.\w]*|)\z#
or die "Invalid file name ($file) in path ($param).\n";
$file= $clean;
my @dirs= splitdir( $dirs );
for my $dir ( @dirs ) {
##( $clean )= $dir =~ m#^([.\w][-.\w]*|)\z#
( $clean )= $dir =~ m#^(\w[-\w]*|)\z#
or die "Invalid dir name ($dir) in path ($param).\n";
$dir= $clean;
}
$dirs= catdir( @dirs );
if( "" eq $dirs && "" eq $file ) {
die "Empty dir/file in path ($param).\n";
}
return catpath( $vol, $dirs, $file );
}