Skip to content

Fix invalid image paths producing invalid epubs #6#7

Draft
deviantintegral wants to merge 2 commits into
wallabag:masterfrom
deviantintegral:6--fix-invalid-paths
Draft

Fix invalid image paths producing invalid epubs #6#7
deviantintegral wants to merge 2 commits into
wallabag:masterfrom
deviantintegral:6--fix-invalid-paths

Conversation

@deviantintegral
Copy link
Copy Markdown

@deviantintegral deviantintegral commented May 24, 2025

Fixes #6.

I've marked this as draft because I'd like to get test coverage in place, but that's also a bigger scope.

Comment thread src/PHPePub/Core/EPub.php
Comment on lines +690 to +691
assert(strlen($lastComponent) <= 255, "File name greater than 255 characters: " . $lastComponent);
assert(strlen($filePath) <= 65535, "File path greater than 65535 characters: " . $filePath);
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even if someone enables assertions in "production" this seems safe to me because the spec says this specifically.

Comment thread src/PHPePub/Core/EPub.php
Comment on lines +696 to +697
assert(preg_match('/^[a-zA-Z0-9\-\_\.\/]+$/', $filePath),
"File path '$filePath' contains invalid characters. Only ASCII letters, numbers, hyphens, underscores, dots and forward slashes are allowed.");
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This, I am less sure about. A filename could contain unicode characters and work fine on a given device or app. But, the spec specifically says that the list of invalid characters is not exhaustive, and that implementations should be conservative. Then again, if this breaks for someone, I also think it would be reasonable to say "just turn off assertions".

@Kdecherf Kdecherf self-requested a review May 12, 2026 14:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Invalid epubs are created if images contain & in their path

1 participant