5

Create a profile named /../../../a

Profile ends up in ~/Applications/a.app

other examples:
Other profile names that include :, / and . may result in the .app suffix not being created, or otherwise not launching the profile app because the location is incorrect

It can also overwrite existing apps too. Suppose you have an app called ~/Applications/a.app, and you create the profile with the name /../../../../a.app then the app gets completely messed up

Proposed solution:
Disallow ., : and / from profile names, and instead show an error to the user.

. could result in unintended behavior if profile name starts with a ., making it hidden
: and / are both path separators in macos, and would cause confusion bc of the internal vs visualization in Finder would differ.

this way, path traversal is impossible

0.99.128.2-rc (WebKit 619.1.11.111.2)

Sonoma (14)

    Maybe do something like this, where certain characters are forcefully converted into dashes.

    This is VSCode. It converts colons into dashes in the save as UI

      eirk changed the title to Sanitize profile names .

        I created a new profile and the name was DEV/TEST. Although this displayed correctly in the UI, it confused the Finder, as on disk the profile's app got created in a subfolder called DEV and within that was Test.app as the name. Seems like the forward slash was being interpreted literally by the filesystem as a path separator and should be escaped?

        I'd expect the profile's app to be created directly in the profile folder, named DEV/TEST.app, rather than a DEV sobfolder created within the profile folder, with an app named TEST.app inside that.

        0.99.127.3-beta (WebKit 619.1.1)

        Sonoma (14)

          Fix would just to convert the forward slash into a colon.

          eg:
          touch : creates a filed named /
          touch a:b creates a file named a/b

            Yeah, I actually deleted it and created one named Dev & Test instead, which seemed to work.

              a month later
              Merged 4 posts from Profile names with a forward slash confuse the filesystem.
                2 months later
                17 days later
                No one is typing