bittornado is too picky about filenames within a torrent.
Even harmless names, such as '...And justice for all' or '.directory'
are considered 'unsafe', and bittornado stops.

Here is a patch to fix this.
New regexp catches all tries to go upwards the directory tree I could
imagine (~user, ../../, /etc/, etc.). Anything else is OK.
Of course, one can download new .bashrc in his homedir.
He could do this with wget as well.

I sent it to upstream author a couple of years ago, but never
got any reply.
Index: BitTornado/BT1/btformats.py
===================================================================
RCS file: /cvsroot/bittornado/BitTornado/BT1/btformats.py,v
retrieving revision 1.3
diff -u -r1.3 btformats.py
--- BitTornado/BT1/btformats.py	25 May 2004 19:00:58 -0000	1.3
+++ BitTornado/BT1/btformats.py	20 Oct 2009 11:30:47 -0000
@@ -4,7 +4,7 @@
 from types import StringType, LongType, IntType, ListType, DictType
 from re import compile
 
-reg = compile(r'^[^/\\.~][^/\\]*$')
+unsafe_file = compile(r'/\.\./|^~|^/|^\.\./')
 
 ints = (LongType, IntType)
 
@@ -20,7 +20,7 @@
     name = info.get('name')
     if type(name) != StringType:
         raise ValueError, 'bad metainfo - bad name'
-    if not reg.match(name):
+    if unsafe_file.search(name):
         raise ValueError, 'name %s disallowed for security reasons' % name
     if info.has_key('files') == info.has_key('length'):
         raise ValueError, 'single/multiple file mix'
@@ -44,7 +44,7 @@
             for p in path:
                 if type(p) != StringType:
                     raise ValueError, 'bad metainfo - bad path dir'
-                if not reg.match(p):
+                if unsafe_file.search(p):
                     raise ValueError, 'path %s disallowed for security reasons' % p
         for i in xrange(len(files)):
             for j in xrange(i):

Reply via email to