sanitize-filename 1.2.1

A simple, dependency-free, blacklist-based filename sanitizer, for when you want to keep the original filename.

Note that a blacklist based sanitizer will never be as safe as a whitelist based one. In most cases, your best option is to create a safe filename yourself. Your second safest option is to use a whitelist approach (allowing only certain characters). This sanitizer is useful when you want to keep the original filename, including non ascii characters, whenever possible. It might be useful for trusted but dirty input, but should not be used with raw user input!

Installation

pip install sanitize_filename

Usage

from sanitize_filename import sanitize


filename = input("Enter a file name:")
filename = sanitize(filename)

Examples:

> sanitize("A/B/C.txt")
'ABC.txt'

> sanitize("this𓀦filenameḜisあactually...valid.txt")
'this𓀦filenameḜisあactually...valid.txt'

> sanitize("def.")
'def'

> sanitize("NUL")
'__NUL'

> sanitize("..")
'__'

Changelog

• 1.2.1

  • Fix a bug where a fullwidth character could be used craft path traversal attack
  • Add some missing Windows device names
  • Remove lone surrogates
  • Fix a bug where names could be crafted to end in a dot.
  • Remove C1 range control characters

• 1.2.0

  • Get rid of os dependent checks; ensure uniform behaviour
  • Now works on long filenames where the non-extensions part consists of only dots

• 1.1.0

  • Try to preserve filename extensions if possible

• 1.0.1

  • First release (as 1.0.1 due to a version number mix-up in 1.0.0)

• 1.0.0-dev3

  • Black list low code point characters (<32)

• 1.0.0-dev1

  • First version