TYPO3 Core

In FAL there are at least two different ways to create files which apparently do not apply the same sanitation/validation rules to file names.

This can be verified easily in the Filelist module: if you try to upload a file called foo@bar.txt everything simply works.

But if you create a file called foo@bar.txt a ResourceDoesNotExistException is thrown:

#1329647780: Object with identifier "1:/foo@bar.txt" does not exist in storage

When opening the file list once more after this, an error flash message is shown which says File name "foo@bar.txt" was not allowed!.

This behavior can be traced back to these two code paths:

• LocalDriver::addFile() calls LocalDriver::sanitizeFileName() which accepts foo@bar.txt (this is used e.g. for file uploads)
• LocalDriver::createFile() calls AbstractDriver::isValidFilename() which denies foo@bar.txt (this is used for everything else)