[Bug] Filter special Unicode characters

[d7oc]

Some characters in Unicode can be used for bad things. One example is the right to left override character (https://unicode-explorer.com/c/202E) which changes the orientation of text. Such characters should be blocked on input.

Steps to reproduce

1. Create a folder name with the RLO character

Expected behaviour

Should be blocked

Actual behaviour

Folder is created which leads to strange effects. Folder is displayed "correct" in the web:

but the Mac Desktop App notification renders strange text (note the RLO character was entered after "Reverse"):

even though the folder in the file system seems to work.

This is only one example. There might be other "bad" character which might possibly harm system and thus should be prohibited.

Environment general

All tested on https://web.cloud.owncloud.com

[pascalwengerter]

Great find, I'm waiting for further clarification from the oCIS backend team on where/how this issue ideally gets tackled 🙂 https://talk.owncloud.com/channel/infinitescale?msg=DqBGjurvRKyB6Za87

[butonic]

When it comes to supported characters oOCIS itself is 'limited' by the underlying storage system capabilities. Some filesystems do not support all UTF-8 characters. Furthermore, some characters can be considered harmful. While I don't think admins should artificially restrict the characterset I see the necessity when technical limitations should be made transparent to the end user.

IMO this is a per space 'trait' and not an instance wide capability. Other traits would be native trash, file revisions or snapshot support. We should introduce a @libregraph.traits array property on drive items where every trait has an id, a name and a display name and can have other properties. The blacklisted files trait could point to an endpoint where clients can get a list of blacklisted filenames?

And a SupportedCharacterSets trait could have an array of supported encodings. if four byte UTF-8 strings are unsupported it could be utf8mb3 as described by mysql.

[micbar]

Let me clarify one thing:

ocis only supports storages with full utf-8 support.

Please be aware that utf8 as it was defined was always referring to the full character set. The distinction with mb3 was added later because of the database systems which didn’t implement UTF8 correctly.

[kulmann]

@pascalwengerter seems to be more complicated to do this properly. I'd suggest that we do one of the two following:

1. keep this issue open as won't fix for now (because what @butonic describes has no priority in the product at the moment)
2. mitigate by preventing the LRO and RLO chars in the web ui only.

I'm in favour of the second option. Also, some refactoring to centralize the file and folder name checks would be good. There are plenty all around the code base at the moment... doesn't feel right.

[pascalwengerter]

Understood, thanks everyone for clarification! 🤗

I'll work on the second option..