<p>If you're worried about malicious characters in an uploaded file name, Craft already <a href="https://github.com/pixelandtonic/Craft-Release/blob/master/app/helpers/AssetsHelper.php#L86" rel="nofollow">sanitizes</a> <a href="https://github.com/pixelandtonic/Craft-Release/blob/master/app/helpers/IOHelper.php#L1499" rel="nofollow">them</a> when uploading from the control panel.</p>

<p>Craft doesn't do this during Asset indexing because generally it's assumed that the files you're uploading are trusted files.</p>

<p>It sounds like that might not be true in your case, though. I can think of two options.</p>

<ol>
<li><p>Write a Craft plugin that loops through all files in your upload folders and calls the same AssetsHelper and IOHelper sanitizing methods that Craft does.</p></li>
<li><p>Find some desktop application that does it before you upload the files. A quick Google search turned up <a href="http://manytricks.com/namemangler/" rel="nofollow">this</a> for OSX, and <a href="http://www.bulkrenameutility.co.uk/Main_Intro.php" rel="nofollow">this</a> for Windows.</p></li>
</ol>

CC BY-SA 3.0
2015-09-23T05:59:09.043Z
It does not sanitize characters in a scenario where you upload thousands of files into the data directory and then hit the button for rebuilding asset indexes - which is my situation at the moment. The files are widely distributed across lots of subdirectories and it makes little sense to upload them manually.
Jan Klan
CC BY-SA 3.0
2015-09-23T20:04:34.993Z
Updated my answer.
Brad Bell
CC BY-SA 3.0
2015-09-24T05:24:43.860Z
I will write the plugin as a practice lesson and will publish it somehow somewhere when I am done with it. Thanks for the answer Brad.
Jan Klan
CC BY-SA 3.0
2015-09-22T19:30:05.937Z
2015-09-24T05:25:45.023Z
2015-09-24T05:25:45.023Z
Brad Bell
<p>is there any built-in way to encode malicious file name characters when getting an asset URL through <code>assetHandle.getUrl('transformationName')</code>?</p>

<p>My system contains files with names such as <code>/assets/images/foo/_transformationName/105 Flippy Dolphin 31 (F60).jpg</code> and escaping the whole string escapes also slashes. </p>

<p>I can assemble a valid URL from <code>asset.directory</code> and <code>asset.filename</code>, but that cuts off access to image transformations.</p>

<p>I do realize I could create a twig extension or explode the string using regular expressions, do my thing and join it back, but I have a feeling this might use some approach more aimed at fixing the cause, not the consequence. The <code>.getUrl()</code> method might be able to return a web-safe value somehow maybe?</p>

<url><image><escape>
URL Encode only file name
# URL Encode only file name

(Asked by: username_0 on 2015-09-22)

is there any built-in way to encode malicious file name characters when getting an asset URL through `assetHandle.getUrl('transformationName')`?

My system contains files with names such as `/assets/images/foo/_transformationName/105 Flippy Dolphin 31 (F60).jpg` and escaping the whole string escapes also slashes.

I can assemble a valid URL from `asset.directory` and `asset.filename`, but that cuts off access to image transformations.

I do realize I could create a twig extension or explode the string using regular expressions, do my thing and join it back, but I have a feeling this might use some approach more aimed at fixing the cause, not the consequence. The `.getUrl()` method might be able to return a web-safe value somehow maybe?

**Tags:** url, image, escape

---

## 1 answers

### Answer by username_1 on 2015-09-22. Score: 0 | Accepted answer

If you're worried about malicious characters in an uploaded file name, Craft already [sanitizes](https://github.com/pixelandtonic/Craft-Release/blob/master/app/helpers/AssetsHelper.php#L86) [them](https://github.com/pixelandtonic/Craft-Release/blob/master/app/helpers/IOHelper.php#L1499) when uploading from the control panel.

Craft doesn't do this during Asset indexing because generally it's assumed that the files you're uploading are trusted files.

It sounds like that might not be true in your case, though. I can think of two options.

1. Write a Craft plugin that loops through all files in your upload folders and calls the same AssetsHelper and IOHelper sanitizing methods that Craft does.
2. Find some desktop application that does it before you upload the files. A quick Google search turned up [this](http://manytricks.com/namemangler/) for OSX, and [this](http://www.bulkrenameutility.co.uk/Main_Intro.php) for Windows.

> **Comments:**
> **username_0**: It does not sanitize characters in a scenario where you upload thousands of files into the data directory and then hit the button for rebuilding asset indexes - which is my situation at the moment. The files are widely distributed across lots of subdirectories and it makes little sense to upload them manually.  
> **username_1**: Updated my answer.  
> **username_0**: I will write the plugin as a practice lesson and will publish it somehow somewhere when I am done with it. Thanks for the answer Brad.  

---

