fix: Check and sanitize filename before passing to file.write (#32)

src/viur/toolkit/importer/importer.py

@@ -9,6 +9,7 @@
 import mimetypes
 import numbers
 import re
+import string
 import time
 import typing as t
 
@@ -262,6 +263,13 @@ def import_file(self, info: dict[str, t.Any]) -> None | db.Key:
 
         logger.debug(f"{name=} has {len(content)!r} bytes")
 
+        if not conf.main_app.vi.file.is_valid_filename(name):
+            logger.error(f"file {name=} is invalid")
+            # simplify name
+            name = "".join(char for char in name if char in string.ascii_letters + string.digits + " _-.")
+            name = name[:conf.main_app.vi.file.MAX_FILENAME_LEN]
+            logger.info(f"Use sanitized {name=}")
+
         if "import_key" in dir(file_skel_cls):
             return conf.main_app.vi.file.write(name, content, mimetype, import_key=info["key"])