From 1ef8a9932b5312c11e6164a0f263f2b2099ca19e Mon Sep 17 00:00:00 2001
From: Kroese <kroese@users.noreply.github.com>
Date: Fri, 19 Jan 2024 03:40:19 +0100
Subject: [PATCH] fix: Sanitize filename

---
 src/install.sh | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/src/install.sh b/src/install.sh
index b107748..ce7872f 100644
--- a/src/install.sh
+++ b/src/install.sh
@@ -48,10 +48,13 @@ fi
 
 MSG="Please wait while Windows is being started..."
 
-if [ ! -f "$STORAGE/custom.iso" ]; then
+BASE="custom.iso"
+if [ ! -f "$STORAGE/$BASE" ]; then
+
   if [[ "$EXTERNAL" != [Yy1]* ]]; then
 
-    if [ ! -f "$STORAGE/$VERSION.iso" ]; then
+    BASE="$VERSION.iso"
+    if [ ! -f "$STORAGE/$BASE" ]; then
       MSG="Please wait while Windows is being downloaded..."
     fi
 
@@ -59,6 +62,8 @@ if [ ! -f "$STORAGE/custom.iso" ]; then
 
     BASE=$(basename "$VERSION")
     BASE="${BASE%%\?*}"
+    : "${BASE//+/ }"; printf -v BASE '%b' "${_//%/\\x}"
+    BASE=$(echo "$BASE" | sed -e 's/[^A-Za-z0-9._-]/_/g')
 
     if [ ! -f "$STORAGE/$BASE" ]; then
       MSG="Please wait while '$BASE' is being downloaded..."
@@ -70,20 +75,6 @@ fi
 # Display wait message
 /run/server.sh "Windows" "$MSG" &
 
-BASE="custom.iso"
-[ -f "$STORAGE/$BASE" ] && return 0
-
-if [[ "$EXTERNAL" != [Yy1]* ]]; then
-
-  BASE="$VERSION.iso"
-
-else
-
-  BASE=$(basename "$VERSION")
-  BASE="${BASE%%\?*}"
-
-fi
-
 [ -f "$STORAGE/$BASE" ] && return 0
 
 TMP="$STORAGE/tmp"