fix: address PR review feedback on filename sanitization

- Remove unused `import re`
- Normalize backslashes to forward slashes before os.path.basename()
  so Windows-style paths (e.g. ..\..\..\evil.txt) are handled on POSIX
- Strip whitespace before removing leading dots so " .env" is caught
- Return None instead of "unnamed" for empty input so existing
  `if not name` validation guards remain effective
- Add `or "unnamed"` fallback at call sites that lack a name guard

Author: sriramveeraghanta

apps/api/plane/api/views/asset.py

@@ -115,7 +115,7 @@ def post(self, request):
         This endpoint generates the necessary credentials for direct S3 upload.
         """
         # get the asset key
-        name = sanitize_filename(request.data.get("name"))
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", False)
@@ -288,7 +288,7 @@ def post(self, request):
         necessary credentials for direct S3 upload with server-side authentication.
         """
         # get the asset key
-        name = sanitize_filename(request.data.get("name"))
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", False)

apps/api/plane/app/views/asset/v2.py

@@ -109,7 +109,7 @@ def entity_asset_delete(self, entity_type, asset, request):
 
     def post(self, request):
         # get the asset key
-        name = sanitize_filename(request.data.get("name"))
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", False)
@@ -313,7 +313,7 @@ def entity_asset_delete(self, entity_type, asset, request):
             return
 
     def post(self, request, slug):
-        name = sanitize_filename(request.data.get("name"))
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type")
@@ -512,7 +512,7 @@ def get_entity_id_field(self, entity_type, entity_id):
 
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def post(self, request, slug, project_id):
-        name = sanitize_filename(request.data.get("name"))
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", "")
@@ -758,7 +758,7 @@ def post(self, request, slug, asset_id):
         if not original_asset:
             return Response({"error": "Asset not found"}, status=status.HTTP_404_NOT_FOUND)
 
-        destination_key = f"{workspace.id}/{uuid.uuid4().hex}-{sanitize_filename(original_asset.attributes.get('name'))}"
+        destination_key = f"{workspace.id}/{uuid.uuid4().hex}-{sanitize_filename(original_asset.attributes.get('name')) or 'unnamed'}"
         duplicated_asset = FileAsset.objects.create(
             attributes={
                 "name": original_asset.attributes.get("name"),

apps/api/plane/app/views/issue/attachment.py

@@ -98,7 +98,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView):
 
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def post(self, request, slug, project_id, issue_id):
-        name = sanitize_filename(request.data.get("name"))
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", False)
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
 

apps/api/plane/db/models/asset.py

@@ -17,7 +17,7 @@
 
 
 def get_upload_path(instance, filename):
-    filename = sanitize_filename(filename)
+    filename = sanitize_filename(filename) or "unnamed"
     if instance.workspace_id is not None:
         return f"{instance.workspace.id}/{uuid4().hex}-{filename}"
     return f"user-{uuid4().hex}-{filename}"

apps/api/plane/db/models/issue.py

@@ -377,7 +377,7 @@ def __str__(self):
 
 
 def get_upload_path(instance, filename):
-    filename = sanitize_filename(filename)
+    filename = sanitize_filename(filename) or "unnamed"
     return f"{instance.workspace.id}/{uuid4().hex}-{filename}"
 
 

apps/api/plane/space/views/asset.py

@@ -74,7 +74,7 @@ def post(self, request, anchor):
             return Response({"error": "Project is not published"}, status=status.HTTP_404_NOT_FOUND)
 
         # Get the asset
-        name = sanitize_filename(request.data.get("name"))
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", "")

apps/api/plane/utils/path_validator.py

@@ -8,7 +8,6 @@
 
 # Python imports
 import os
-import re
 from urllib.parse import urlparse
 
 
@@ -18,27 +17,36 @@ def sanitize_filename(filename):
 
     Strips directory components, path traversal sequences, and null bytes
     from user-supplied filenames used in upload paths and S3 object keys.
+
+    Returns None for empty/missing input so callers can still validate
+    that a filename was provided.
     """
     if not filename or not isinstance(filename, str):
-        return "unnamed"
+        return None
 
     # Strip null bytes
     filename = filename.replace("\x00", "")
 
+    # Normalize backslashes so os.path.basename handles Windows-style paths on POSIX
+    filename = filename.replace("\\", "/")
+
     # Take only the basename to remove any directory components
     filename = os.path.basename(filename)
 
     # Remove any remaining path traversal sequences
     filename = filename.replace("..", "")
 
+    # Strip whitespace before removing leading dots so " .env" is caught
+    filename = filename.strip()
+
     # Remove leading dots (hidden files)
     filename = filename.lstrip(".")
 
-    # Strip whitespace
+    # Strip any remaining whitespace
     filename = filename.strip()
 
     if not filename:
-        return "unnamed"
+        return None
 
     return filename