makeplane / makeplane/plane

[Security/Medium]: Filename Sanitization Does Not Strip Control Characters

Open
#9,126 0 comments 0 reactions 1 assignee View on GitHub

@pablohashescobar is already working on this.

Since May 25, 2026.

Dominant language
TypeScript
Stars
59.6k
Forks
5.8k
Avg merge
1d 22h
Merged PRs (30d)
49

Description

Description

The sanitize_filename() function in apps/api/plane/utils/path_validator.py does not strip control characters (e.g., \t, \n, \r, \v, \f) from user-provided filenames. This function is used when generating S3 object keys for file uploads (user avatars, workspace logos, project covers, etc.).

Steps to Reproduce

  1. Send a POST request to /api/v2/workspace/:slug/asset-upload/ with a filename containing control characters: 
    curl -X POST https://plane.so/api/v2/workspace/test/asset-upload/ \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d {

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.