From 278e4c2de73bd884b0512cb4456ff143d8973327 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 14 Mar 2026 23:07:49 +0000
Subject: [PATCH] fix: prevent path traversal in MetadataEngine subfolder
 generation

The `SanitizeForPath` method was vulnerable to path traversal attacks because it only removed invalid filename characters but allowed dots ('.'), meaning inputs like ".." were preserved.

This commit updates `SanitizeForPath` to also remove all dot characters from the folder name, ensuring that it cannot be used to navigate up the directory hierarchy. A new test class `MetadataEngineTests` has been added to verify this behavior.

Co-authored-by: gonzoga <6003443+gonzoga@users.noreply.github.com>
---
 FileOrganizer.Tests/MetadataEngineTests.cs | 33 ++++++++++++++++++++++
 FileOrganizer/Engines/MetadataEngine.cs    |  4 +++
 2 files changed, 37 insertions(+)
 create mode 100644 FileOrganizer.Tests/MetadataEngineTests.cs

diff --git a/FileOrganizer.Tests/MetadataEngineTests.cs b/FileOrganizer.Tests/MetadataEngineTests.cs
new file mode 100644
index 0000000..adb043d
--- /dev/null
+++ b/FileOrganizer.Tests/MetadataEngineTests.cs
@@ -0,0 +1,33 @@
+using System;
+using System.Reflection;
+using FileOrganizer.Engines;
+using Xunit;
+
+namespace FileOrganizer.Tests
+{
+    public class MetadataEngineTests
+    {
+        private readonly MetadataEngine _engine = new MetadataEngine();
+
+        private string CallSanitizeForPath(string input)
+        {
+            var method = typeof(MetadataEngine).GetMethod("SanitizeForPath", BindingFlags.NonPublic | BindingFlags.Instance);
+            return (string)method.Invoke(_engine, new object[] { input });
+        }
+
+        [Theory]
+        [InlineData("ValidName", "ValidName")]
+        [InlineData("  TrimmedName  ", "TrimmedName")]
+        [InlineData("Name/With/Slash", "NameWithSlash")]
+        [InlineData("Name\\With\\Backslash", "NameWithBackslash")]
+        [InlineData("..", "Unknown")]
+        [InlineData("../etc/passwd", "etcpasswd")]
+        [InlineData(".", "Unknown")]
+        [InlineData("valid.name", "validname")]
+        public void SanitizeForPath_RemovesInvalidAndPathTraversalChars(string input, string expected)
+        {
+            string actual = CallSanitizeForPath(input);
+            Assert.Equal(expected, actual);
+        }
+    }
+}
diff --git a/FileOrganizer/Engines/MetadataEngine.cs b/FileOrganizer/Engines/MetadataEngine.cs
index 33c3697..046ebb8 100644
--- a/FileOrganizer/Engines/MetadataEngine.cs
+++ b/FileOrganizer/Engines/MetadataEngine.cs
@@ -130,10 +130,14 @@ private string GetImageSubFolder(string filePath)
         private string SanitizeForPath(string folderName)
         {
             folderName = folderName.Trim();
+            // Remove invalid characters for a file name
             foreach (char c in Path.GetInvalidFileNameChars())
             {
                 folderName = folderName.Replace(c.ToString(), "");
             }
+            // Remove dots to prevent path traversal (e.g., ".." or ".")
+            folderName = folderName.Replace(".", "");
+
             return folderName.Length > 0 ? folderName : "Unknown";
         }
     }