2 files changed, 32 insertions, 54 deletions

diff --git a/src/utils/stringutils.cpp b/src/utils/stringutils.cpp
index 747243fd..0244dd8c 100644
--- a/src/utils/stringutils.cpp
+++ b/src/utils/stringutils.cpp
@@ -101,16 +101,15 @@ std::string strprintf(char const *format, ...)
     return res;
 }
 
-std::string &removeBadChars(std::string &str)
+std::string &replaceCharacters(std::string &str,
+                               std::string_view chars,
+                               char replacement)
 {
-    std::string::size_type pos;
-    do
+    for (auto &c : str)
     {
-        pos = str.find_first_of("@#[]");
-        if (pos != std::string::npos)
-            str.erase(pos, 1);
-    } while (pos != std::string::npos);
-
+        if (chars.find(c) != std::string::npos)
+            c = replacement;
+    }
     return str;
 }
 
@@ -220,49 +219,27 @@ std::string normalize(const std::string &name)
     return toLower(trim(normalized));
 }
 
-std::string removeTrailingSymbol(const std::string &s, const char c)
+std::string getDirectoryFromURL(const std::string &url)
 {
-    // Remove the trailing symblol at the end of the string
-    if (!s.empty() && s.at(s.size() - 1) == c)
-        return s.substr(0, s.size() - 1);
-    return std::string(s);
-}
-
-std::string getHostNameFromURL(const std::string &url)
-{
-    std::string myHostName;
-
-    // Don't go out of range in the next check
-    if (url.length() < 2)
-        return myHostName;
+    std::string directory = url;
 
-    // Remove any trailing slash at the end of the update host
-    myHostName = removeTrailingSymbol(url, '/');
+    // Parse out any "http://", "ftp://", etc...
+    size_t pos = directory.find("://");
+    if (pos != std::string::npos)
+        directory.erase(0, pos + 3);
 
-    // Parse out any "http://", "ftp://", ect...
-    size_t pos = myHostName.find("://");
-    if (pos == std::string::npos)
-    {
-        logger->log("Warning: no protocol was specified for the url: %s",
-                    url.c_str());
-    }
+    // Replace characters which are not valid or difficult in file system paths
+    replaceCharacters(directory, ":*?\"<>| ", '_');
 
-    if (myHostName.empty() || pos + 3 >= myHostName.length())
+    // Replace ".." (double dots) with "_" to avoid directory traversal.
+    pos = directory.find("..");
+    while (pos != std::string::npos)
     {
-        logger->log("Error: Invalid url: %s", url.c_str());
-        return myHostName;
+        directory.replace(pos, 2, "_");
+        pos = directory.find("..");
     }
-    myHostName = myHostName.substr(pos + 3);
-
-    // Remove possible trailing port (i.e.: localhost:8000 -> localhost)
-    pos = myHostName.find(":");
-    if (pos != std::string::npos)
-        myHostName = myHostName.substr(0, pos);
-
-    // remove possible other junk
-    removeBadChars(myHostName);
 
-    return myHostName;
+    return directory;
 }
 
 std::string join(const std::vector<std::string> &strings, const char *separator)
diff --git a/src/utils/stringutils.h b/src/utils/stringutils.h
index ca54803d..349d2a66 100644
--- a/src/utils/stringutils.h
+++ b/src/utils/stringutils.h
@@ -95,12 +95,16 @@ std::string strprintf(char const *, ...)
 ;
 
 /**
- * Removes bad characters from a string
+ * Replaces a set of characters with another character.
  *
  * @param str the string to remove the bad chars from
+ * @param chars the bad characters to remove
+ * @param replacement the character to replace the bad chars with
  * @return a reference to the string without bad chars
  */
-std::string &removeBadChars(std::string &str);
+std::string &replaceCharacters(std::string &str,
+                               std::string_view chars,
+                               char replacement = '_');
 
 /**
  * Removes colors from a string
@@ -210,15 +214,12 @@ std::string autocomplete(const std::vector<std::string> &candidates,
 std::string normalize(const std::string &name);
 
 /**
- * Remove a potential trailing symbol from a string.
- */
-std::string removeTrailingSymbol(const std::string &s, const char c);
-
-/**
- * Gets the hostname out of the given URL.
- * i.e.: http://www.manasource.org:9601 -> www.manasource.org
+ * Derives a directory from the given URL, stripping the schema and replacing
+ * certain invalid characters.
+ *
+ * i.e.: http://www.manasource.org:9601/updates/ -> www.manasource.org_9601/updates/
  */
-std::string getHostNameFromURL(const std::string &url);
+std::string getDirectoryFromURL(const std::string &url);
 
 /**
  * Joins a vector of strings into one string, separated by the given