MEDIUM: Download filename vulnerable to injection / path traversal #4

New issue

Closed

opened 2026-05-09 05:09:55 +00:00 by Mark · 2 comments

Mark commented

2026-05-09 05:09:55 +00:00

Owner

Severity: MEDIUM

Location

tokengenerator.html, lines 382-385:

const textPart = textInput.value.replace(/\s+/g, '_') || 'token';
const iconPart = generatedIconImage ? 'ai_generated' : iconSelect.value;
link.download = `token_${textPart}_${iconPart}.png`;

Description

The download filename is constructed from unsanitized user input. The only sanitization is replacing whitespace with underscores. Characters like ../, \0, %00, and / pass through unchanged. While browsers typically sanitize download filenames, this can still cause issues:

Misleading filenames: Users could craft filenames that look like system files.
Path traversal in download dialogs: Some browsers/OS may interpret ../ in filenames.
Hidden file extensions: Malicious users could inject null bytes or other characters.

Recommended Fix

Strip or replace all non-alphanumeric characters (except underscore/hyphen) from the filename.
Use a regex like /^[\\w-]+$/ validation or replace everything outside [a-zA-Z0-9_-].

Impact

Could allow filename spoofing or potential path traversal issues depending on browser/OS.

## Severity: MEDIUM ## Location `tokengenerator.html`, lines 382-385: ```javascript const textPart = textInput.value.replace(/\s+/g, '_') || 'token'; const iconPart = generatedIconImage ? 'ai_generated' : iconSelect.value; link.download = `token_${textPart}_${iconPart}.png`; ``` ## Description The download filename is constructed from unsanitized user input. The only sanitization is replacing whitespace with underscores. Characters like `../`, `\0`, `%00`, and `/` pass through unchanged. While browsers typically sanitize download filenames, this can still cause issues: - **Misleading filenames**: Users could craft filenames that look like system files. - **Path traversal in download dialogs**: Some browsers/OS may interpret `../` in filenames. - **Hidden file extensions**: Malicious users could inject null bytes or other characters. ### Recommended Fix - Strip or replace all non-alphanumeric characters (except underscore/hyphen) from the filename. - Use a regex like `/^[\\w-]+$/` validation or replace everything outside `[a-zA-Z0-9_-]`. ### Impact Could allow filename spoofing or potential path traversal issues depending on browser/OS.