From 3fadf141e66c8d0baaa66574fa3b63c4d3655482 Mon Sep 17 00:00:00 2001
From: Hrushikesh Vaidya <hrushikeshrv@gmail.com>
Date: Mon, 17 Jan 2022 14:42:48 +0530
Subject: Fixed #33062 -- Made MultiPartParser remove non-printable chars from
 file names.

---
 django/http/multipartparser.py | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'django/http')

diff --git a/django/http/multipartparser.py b/django/http/multipartparser.py
index ddf7cfa2f6..c3cb90e639 100644
--- a/django/http/multipartparser.py
+++ b/django/http/multipartparser.py
@@ -320,6 +320,8 @@ class MultiPartParser:
         file_name = html.unescape(file_name)
         file_name = file_name.rsplit('/')[-1]
         file_name = file_name.rsplit('\\')[-1]
+        # Remove non-printable characters.
+        file_name = ''.join([char for char in file_name if char.isprintable()])
 
         if file_name in {'', '.', '..'}:
             return None
-- 
cgit v1.3