Page History

...

• Leading dashes: Leading dashes can cause problems when programs are called with the file name as a parameter because the first character or characters of the file name might be interpreted as an option switch.
• Control characters, such as newlines, carriage returns, and escape: Control characters in a file name can cause unexpected results from shell scripts and in logging.
• Spaces: Spaces can cause problems with scripts and when double quotes aren't used to surround the file name.
• Invalid character encodings: Character encodings can make it difficult to perform proper validation of file and path names. (See rule IDS11-J. Eliminate noncharacter code points before validation).
• Name-space separation characters: Including name-space separation characters in a file or path name can cause unexpected and potentially insecure behavior.
• Command interpreters, scripts, and parsers: Some characters have special meaning when processed by a command interpreter, shell, or parser and should consequently be avoided.

Wiki MarkupAs a result of the influence of MS-DOS, file names of the form {{xxxxxxxx.xxx}}, where {{x}} denotes an alphanumeric character, are generally supported by modern systems. On some platforms, file names are case sensitive; while on other platforms, they are case insensitive. VU#439395 is an example of a vulnerability in C resulting from a failure to deal appropriately with case sensitivity issues \[ [VU#439395|AA. References#VU439395]\].

This is a specific instance of rule IDS00-J. Sanitize untrusted data passed across a trust boundary.

...

...

...

            IDS06-J. Exclude user input from format strings