10 ms·

I bet there is another vulnerability here, although they also seem to blacklist % and ..

naikrovek 3y ago
most of those are the usual forbidden path and filename characters. % is used to surround environment variables for interpretation, for example.
- lostlogin 3y ago
  > the usual forbidden path and filename characters. It’s pretty irritating when files and folders on my Mac can’t be uploaded to Teams due to this limitation. It’s only forbidden for Windows users.
  - reaperducer 3y ago
    It’s only forbidden for Windows users. I think the only character that Macs don't allow is the colon. AFAIK, everything else is fair game, even emojis. I just created a project with "ê" in the title. I wonder if I'll be able to share that with my Windows coworkers on Teams.
    - recursive 3y ago
      Yes. NTFS has no problem with non-latin letters and emojis in file names.
      - qingcharles 3y ago
        I had to test it, but this is true. I just renamed my TODO.txt to [sobbing emoji].txt
      - justsomehnguy 3y ago
        NTFS itself has not that many forbidden characters (though ':' is one of them, it denotes alternate stream). What people think about those CON, PRN, AUX, NUL etc are not filesystem limitation. And while we are here - nor backslash, nor forward slash are used in NTFS. It can care less about what char do you use for a directory separator. Just be sure to update your APIs.
        nxobject 3y ago
        NTFS on non-Windows systems aside, I wonder whether there are any "pure NT" environments you can access in Windows where you can create and use these folders.
        tenebrisalietum 3y ago
        You can do some stuff under Cygwin that's bothersome under explorer.exe, like delete files with really long pathnames.
        bombcar 3y ago
        You just need to come in below whatever layer notices them. I'm sure they've been used to smuggle viruses in, so the layer that blocks them may get lower and lower.
    - OnlyMortal 3y ago
      “:”? Really? It’s not 2001 anymore.
      - reaperducer 3y ago
        I guess you're criticizing Microsoft's NTFS, since it cannot use colons, either. CON:? Really? It's not 1974 anymore. People in glass houses shouldn't throw stones.
        lostlogin 3y ago
        ? No it is not 1974, but not everything is better. Edit: argh, HN deleted the emoticon. Ironic.
        deleted 3y ago
        [deleted]
    - yjftsjthsd-h 3y ago
      > AFAIK, everything else is fair game, even emojis FWIW, I generally expect emojis to be more compatible than other symbols, because they have no legacy meanings - ex. ™ has never been a path separator, or indeed anything else.
      - extraduder_ire 3y ago
        Main problem with "emojis" is that they live outside the basic multilingual plane, and so make bad utf-16 handling really obvious. This is a blessing in disguise, because it acts as a no-brown-m&ms thing, since it's more unarguably broken than not being able to use cuneiform, or musical symbols.
        yjftsjthsd-h 3y ago
        Yeah, point; I probably should have said something more like "emoji shouldn't have alternative meanings, so they should work if your unicode support is functional (which is a big caveat)." On the bright side, yeah, emoji have been great at pushing things to handle unicode nicely and act as a... I dunno, natural fuzzing case?
      - veave 3y ago
        ™ is not an emoji. It's part of the "Letterlike Symbols" block.
        yjftsjthsd-h 3y ago
        Oops, good point. I think I'm going to leave it as-is on account of not knowing of any actual emoji that HN allows, but yes that is technically incorrect on my part.
        veave 3y ago
        I think the confusion comes from the fact that some platforms render it as a drawing as if it was an emoji. I never understood why...
    - hn92726819 3y ago
      It looks like non-utf8 is not allowed: https://superuser.com/questions/204287/what-characters-are-forbidden-in-os-x-filenames https://superuser.com/questions/204287/what-characters-are-f... Maybe it goes without saying, but for completeness, / is not allowed in filenames, and neither is null terminator (0x00 or \0) on mac either. On Linux, only / and null terminator are banned from filenames.
      - slaymaker1907 3y ago
        Sadly, you are not correct about slashes. They are allowed in filenames for Macs https://alexwlchan.net/2021/slashes/ https://alexwlchan.net/2021/slashes/
        vtee44 3y ago
        It doesn’t make sense tbh, it just causes confusion when someone is using terminal. Slashes in file names are forbidden everywhere except Mac, it needs to be changed in order to send it anywhere or use in some apps. But I think colon is used much more in names. I don’t get why did they do that.
        lostlogin 3y ago
        Based on this logic, do we ban everything that is banned somewhere? Surely we can aim higher than the lowest common denominator.
        vtee44 3y ago
        Slashes are used in paths, so most programs that aren’t Mac-exclusive would use them to build a path to file. To make it work properly in cross-platform programs you’d need to write platform-specific code to handle that. It just adds complexity and possible errors. Even system terminal doesn’t display it as slash and it doesn’t work if you write slashes. For users of other platforms (at least 90% of desktop market) it would just display as slashes. Just not implementing this workaround would make it predictable when moving and using files.
    - slaymaker1907 3y ago
      Yes, and it was an absolutely horrible mistake in the other direction. If I give you a path “./something/example.txt” it could be a file called example.txt in a folder called something or it could be a single file called “something/example.txt”.
      - markrages 3y ago
        > disallows the ascii slash
    - aidenn0 3y ago
      Linux treats filenames as bytes and only disallows the ascii slash and null. All other bytes are fair game.
      - cesarb 3y ago
        > [...] and only disallows the ascii slash and null. All other bytes are fair game. There's also the special treatment of "", ".", and ".." (that is, a file or directory name consisting entirely of zero, one, or two dots), and the convention that a name starting with a dot is hidden.
        inkyoto 3y ago
        > and the convention that a name starting with a dot is hidden. It is a UNIX shell implementation level convention. The file system and the kernel don't care, and a shell is not obliged to honour the convention.
    - duskwuff 3y ago
      > I think the only character that Macs don't allow is the colon. Colon is allowed in the filesystem; it's displayed as a forward slash in the UI. (There's historical reasons they do this: Classic Mac OS used colon as a path separator.)
      - IIsi50MHz 3y ago
        And it was merely not recommended to use a fullstop at the start of a filename. Device drivers —perhaps just for storage devices — were usually named this way (and also marked invisible). There was an alleged chance the OS would try to load your non-driver file as a driver for the device it resided on. Though I was unable to make it happen.
  - mihaaly 3y ago
    Once I planned to share files between a Mac and a Win PC through a product synching folders but gave up very soon due to the constant errors and problems with file names worked in one but not in the other, dominantly filenames that I did not choose but received (e.g. link dragged from address bar to folder, but others too) but some I choose following some preexisting logic.
Dwedit 3y ago
\\?\GLOBALROOT\ anyone? Now you're opening devices from the NT object namespace rather than files. Bonus: You can create the file C:\con\con using NT Native API filesystem calls. Someone even made a video of installing Windows into C:\con\con, and the kernel-side stuff works beautifully, and the explorer shell side dies horribly.
- dustingetz 3y ago
  AOL chat would bluescreen a Win95 box if someone sent a chat message like “}s\con\con” - }s was the directive to play a sound
  - IIsi50MHz 3y ago
    I believe it was more like: {s buddyin.wav} At some point, I think it would only play sound files in the program's folder. I have the vague feeling that it was later changed to an AOL-created subfolder unique to each Windows user.
- rejectfinite 3y ago
  >the kernel-side stuff works beautifully, and the explorer shell side dies horribly. So, just like running Windows normally then? :D
  - postmodest 3y ago
    NT is Dave Cutler's best ideas for OS design, atop which Very Bad People piled the Win95 API and UX

most of those are the usual forbidden path and filename characters. % is used to surround environment variables for interpretation, for example.

lostlogin 3y ago
> the usual forbidden path and filename characters. It’s pretty irritating when files and folders on my Mac can’t be uploaded to Teams due to this limitation. It’s only forbidden for Windows users.
- reaperducer 3y ago
  It’s only forbidden for Windows users. I think the only character that Macs don't allow is the colon. AFAIK, everything else is fair game, even emojis. I just created a project with "ê" in the title. I wonder if I'll be able to share that with my Windows coworkers on Teams.
  - recursive 3y ago
    Yes. NTFS has no problem with non-latin letters and emojis in file names.
    - qingcharles 3y ago
      I had to test it, but this is true. I just renamed my TODO.txt to [sobbing emoji].txt
    - justsomehnguy 3y ago
      NTFS itself has not that many forbidden characters (though ':' is one of them, it denotes alternate stream). What people think about those CON, PRN, AUX, NUL etc are not filesystem limitation. And while we are here - nor backslash, nor forward slash are used in NTFS. It can care less about what char do you use for a directory separator. Just be sure to update your APIs.
      - nxobject 3y ago
        NTFS on non-Windows systems aside, I wonder whether there are any "pure NT" environments you can access in Windows where you can create and use these folders.
        tenebrisalietum 3y ago
        You can do some stuff under Cygwin that's bothersome under explorer.exe, like delete files with really long pathnames.
        bombcar 3y ago
        You just need to come in below whatever layer notices them. I'm sure they've been used to smuggle viruses in, so the layer that blocks them may get lower and lower.
  - OnlyMortal 3y ago
    “:”? Really? It’s not 2001 anymore.
    - reaperducer 3y ago
      I guess you're criticizing Microsoft's NTFS, since it cannot use colons, either. CON:? Really? It's not 1974 anymore. People in glass houses shouldn't throw stones.
      - lostlogin 3y ago
        ? No it is not 1974, but not everything is better. Edit: argh, HN deleted the emoticon. Ironic.
        deleted 3y ago
        [deleted]
  - yjftsjthsd-h 3y ago
    > AFAIK, everything else is fair game, even emojis FWIW, I generally expect emojis to be more compatible than other symbols, because they have no legacy meanings - ex. ™ has never been a path separator, or indeed anything else.
    - extraduder_ire 3y ago
      Main problem with "emojis" is that they live outside the basic multilingual plane, and so make bad utf-16 handling really obvious. This is a blessing in disguise, because it acts as a no-brown-m&ms thing, since it's more unarguably broken than not being able to use cuneiform, or musical symbols.
      - yjftsjthsd-h 3y ago
        Yeah, point; I probably should have said something more like "emoji shouldn't have alternative meanings, so they should work if your unicode support is functional (which is a big caveat)." On the bright side, yeah, emoji have been great at pushing things to handle unicode nicely and act as a... I dunno, natural fuzzing case?
    - veave 3y ago
      ™ is not an emoji. It's part of the "Letterlike Symbols" block.
      - yjftsjthsd-h 3y ago
        Oops, good point. I think I'm going to leave it as-is on account of not knowing of any actual emoji that HN allows, but yes that is technically incorrect on my part.
        veave 3y ago
        I think the confusion comes from the fact that some platforms render it as a drawing as if it was an emoji. I never understood why...
  - hn92726819 3y ago
    It looks like non-utf8 is not allowed: https://superuser.com/questions/204287/what-characters-are-forbidden-in-os-x-filenames https://superuser.com/questions/204287/what-characters-are-f... Maybe it goes without saying, but for completeness, / is not allowed in filenames, and neither is null terminator (0x00 or \0) on mac either. On Linux, only / and null terminator are banned from filenames.
    - slaymaker1907 3y ago
      Sadly, you are not correct about slashes. They are allowed in filenames for Macs https://alexwlchan.net/2021/slashes/ https://alexwlchan.net/2021/slashes/
      - vtee44 3y ago
        It doesn’t make sense tbh, it just causes confusion when someone is using terminal. Slashes in file names are forbidden everywhere except Mac, it needs to be changed in order to send it anywhere or use in some apps. But I think colon is used much more in names. I don’t get why did they do that.
        lostlogin 3y ago
        Based on this logic, do we ban everything that is banned somewhere? Surely we can aim higher than the lowest common denominator.
        vtee44 3y ago
        Slashes are used in paths, so most programs that aren’t Mac-exclusive would use them to build a path to file. To make it work properly in cross-platform programs you’d need to write platform-specific code to handle that. It just adds complexity and possible errors. Even system terminal doesn’t display it as slash and it doesn’t work if you write slashes. For users of other platforms (at least 90% of desktop market) it would just display as slashes. Just not implementing this workaround would make it predictable when moving and using files.
  - slaymaker1907 3y ago
    Yes, and it was an absolutely horrible mistake in the other direction. If I give you a path “./something/example.txt” it could be a file called example.txt in a folder called something or it could be a single file called “something/example.txt”.
    - markrages 3y ago
      > disallows the ascii slash
  - aidenn0 3y ago
    Linux treats filenames as bytes and only disallows the ascii slash and null. All other bytes are fair game.
    - cesarb 3y ago
      > [...] and only disallows the ascii slash and null. All other bytes are fair game. There's also the special treatment of "", ".", and ".." (that is, a file or directory name consisting entirely of zero, one, or two dots), and the convention that a name starting with a dot is hidden.
      - inkyoto 3y ago
        > and the convention that a name starting with a dot is hidden. It is a UNIX shell implementation level convention. The file system and the kernel don't care, and a shell is not obliged to honour the convention.
  - duskwuff 3y ago
    > I think the only character that Macs don't allow is the colon. Colon is allowed in the filesystem; it's displayed as a forward slash in the UI. (There's historical reasons they do this: Classic Mac OS used colon as a path separator.)
    - IIsi50MHz 3y ago
      And it was merely not recommended to use a fullstop at the start of a filename. Device drivers —perhaps just for storage devices — were usually named this way (and also marked invisible). There was an alleged chance the OS would try to load your non-driver file as a driver for the device it resided on. Though I was unable to make it happen.
- mihaaly 3y ago
  Once I planned to share files between a Mac and a Win PC through a product synching folders but gave up very soon due to the constant errors and problems with file names worked in one but not in the other, dominantly filenames that I did not choose but received (e.g. link dragged from address bar to folder, but others too) but some I choose following some preexisting logic.

Dwedit 3y ago

\\?\GLOBALROOT\ anyone? Now you're opening devices from the NT object namespace rather than files. Bonus: You can create the file C:\con\con using NT Native API filesystem calls. Someone even made a video of installing Windows into C:\con\con, and the kernel-side stuff works beautifully, and the explorer shell side dies horribly.

dustingetz 3y ago
AOL chat would bluescreen a Win95 box if someone sent a chat message like “}s\con\con” - }s was the directive to play a sound
- IIsi50MHz 3y ago
  I believe it was more like: {s buddyin.wav} At some point, I think it would only play sound files in the program's folder. I have the vague feeling that it was later changed to an AOL-created subfolder unique to each Windows user.
rejectfinite 3y ago
>the kernel-side stuff works beautifully, and the explorer shell side dies horribly. So, just like running Windows normally then? :D
- postmodest 3y ago
  NT is Dave Cutler's best ideas for OS design, atop which Very Bad People piled the Win95 API and UX