Windows: Block alternate data streams

liyboy · Mar 30, 2022 · 3c218ec · 3c218ec
1 parent 0baf1dc
commit 3c218ec
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/radicale/pathutils.py b/radicale/pathutils.py
@@ -257,6 +257,7 @@ def is_safe_filesystem_path_component(path: str) -> bool:
     """
     return (
         bool(path) and not os.path.splitdrive(path)[0] and
+        (sys.platform != "win32" or ":" not in path) and  # Block NTFS-ADS
         not os.path.split(path)[0] and path not in (os.curdir, os.pardir) and
         not path.startswith(".") and not path.endswith("~") and
         is_safe_path_component(path))