Code injection via file names

[JW]

On Unix, almost all characters can be used in filenames. This means the following filenames can be used:
  <script>alert(1)</script>.txt
  ' OR 1=1--.txt
  ' style='test'.txt

On certain places, this can cause problems. In Admin::EntriesController#write, no SQL is directly called, all filenames that are stored in the database should be escaped properly.

In app/views/admin/entries/_type_image.rhtml and .../_type_music.rhtml, however, the following is written:
  if @entry and @entry.type.name == "image" and @entry.contents.length != 0
    "<a href='/" + @entry.contents + "'>View the currently uploaded image</a>" +
    "<br />Upload a new image: "
  end
@entry.contents should be URL escaped.

It is possible that there are still other vulnerabilities related to filenames, in other code. This needs to be checked.

(This error was found thanks to a presentation available at http://events.ccc.de/congress/2007/Fahrplan/events/2212.en.html)

[JW (jw-00000)]

Please note this vulnerability can only be triggered by the administrator, or by someone accidentally uploading files with a vulnerable name.

[JW (jw-00000)]

This is not a problem, since filenames are saved using their ID. So, filenames are always replaced with numbers.