in reply to Untainting 'bad' filenames

Sounds to me like another file upload script. If you don't have control over where the file is coming from, then how do you know that it's not still being written to? You wouldn't want to move it before it's done...

Replies are listed 'Best First'.
Re: Re: Untainting 'bad' filenames
by turnstep (Parson) on Dec 08, 2000 at 17:28 UTC

    elwarren brings up a good point about checking to see whether the file is still in the middle of being ftp'ed by another process. If you are on a unix (or Solaris, Linux, etc.) box, check out the fuser command. See your local manpage for more info on it.

      Sometimes I get around this by writing out a second file after the first is completely written. Then the process polls the directory looking for filename.whatever.done When the .done file shows up I know it's safe to move the file I actually want.

      Reading some fresh posts it looks like you're grabbing files from a custom ftp server, so this really isn't a solution for your problem...