Reduce a remote-supplied file name to a safe basename with no path traversal.
A transfer's metadata.name is an arbitrary attacker-controlled string
(../../etc/passwd, C:\\evil, a NUL byte, …). Any app that builds a Node
sink path from it — e.g. join(dir, transfer.fileName) — must sanitize first.
This takes the last path segment and strips reserved/control characters,
falling back to download when nothing usable remains.
Parameters
name: string
The raw file name from the transfer offer.
Returns string
A safe basename containing no separators, leading dots, control, or
reserved characters.
Reduce a remote-supplied file name to a safe basename with no path traversal.
A transfer's
metadata.nameis an arbitrary attacker-controlled string (../../etc/passwd,C:\\evil, a NUL byte, …). Any app that builds a Node sink path from it — e.g.join(dir, transfer.fileName)— must sanitize first. This takes the last path segment and strips reserved/control characters, falling back todownloadwhen nothing usable remains.