fix(api-client): sanitize file name thoroughly

api-client/src/system/__tests__/utils.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest'
+import { sanitizeFileName } from '../utils'
+
+describe('sanitizeFileName', () => {
+  it('returns original alphanumeric file name', () => {
+    expect(sanitizeFileName('an0ther_otie_logo.png')).toEqual(
+      'an0ther_otie_logo.png'
+    )
+  })
+
+  it('sanitizes a file name', () => {
+    expect(
+      sanitizeFileName(
+        `otie's birthday/party - (& the bouncy castle cost ~$100,000).jpeg`
+      )
+    ).toEqual(
+      'otie_s_birthday_party_-____the_bouncy_castle_cost___100_000_.jpeg'
+    )
+  })
+})

api-client/src/system/createSplash.ts

@@ -1,13 +1,15 @@
 import { POST, request } from '../request'
+import { sanitizeFileName } from './utils'
 import type { ResponsePromise } from '../request'
 import type { HostConfig } from '../types'
 
 export function createSplash(
   config: HostConfig,
   file: File
 ): ResponsePromise<void> {
-  // sanitize file name to ensure no spaces
-  const renamedFile = new File([file], file.name.replace(' ', '_'), {
+  // sanitize file name to ensure no spaces or special characters
+  const newFileName = sanitizeFileName(file.name)
+  const renamedFile = new File([file], newFileName, {
     type: 'image/png',
   })
 

api-client/src/system/index.ts

@@ -3,3 +3,4 @@ export { createRegistration } from './createRegistration'
 export { createSplash } from './createSplash'
 export { getConnections } from './getConnections'
 export * from './types'
+export * from './utils'

api-client/src/system/utils.ts

@@ -0,0 +1,3 @@
+export function sanitizeFileName(fileName: string): string {
+  return fileName.replace(/[^a-zA-Z0-9-.]/gi, '_')
+}