X-Git-Url: https://git.phdru.name/?a=blobdiff_plain;f=mimedecode.py;h=da63350485e7981713b88257bbccc12bb711efd2;hb=d7aac25395b00e62c5c79160b81dbfcb58f14bcd;hp=392e70774e5f1cb2537c5b94fa87906a71470f22;hpb=b92e86cc18ad38cd2c8db1a3217ca2fed1c50c2f;p=mimedecode.git

diff --git a/mimedecode.py b/mimedecode.py
index 392e707..da63350 100755
--- a/mimedecode.py
+++ b/mimedecode.py
@@ -270,6 +270,12 @@ def _save_message(msg, outstring, save_headers=False, save_body=False):
     ):
         fname = msg.get_param(param, header=header)
         if fname:
+            try:
+                    for forbidden in chr(0), '/', '\\':
+                        if forbidden in fname:
+                            raise ValueError
+            except ValueError:
+                continue
             fname = '-' + fname
             break
     else:
@@ -396,7 +402,16 @@ def decode_message(msg):
 
 
 def open_output_file(filename):
-    return open(os.path.join(g.destination_dir, filename), 'w')
+    fullpath = os.path.abspath(os.path.join(g.destination_dir, filename))
+    full_dir = os.path.dirname(fullpath)
+    create = not os.path.isdir(full_dir)
+    if create:
+        os.makedirs(full_dir)
+    try:
+        return open(fullpath, 'w')
+    except:
+        if create:
+            os.removedirs(full_dir)
 
 
 class GlobalOptions: