Avoid path traversal in disk writer.

Thanks to Stefan Vinck of Radically Open Security.

diskwriter/diskwriter.go

@@ -243,6 +243,17 @@ func (conn *diskConn) Close() error {
 	return nil
 }
 
+var replacer = strings.NewReplacer(
+	"/", "-slash-",
+	"\\", "-backslash-",
+)
+
+// sanitise sanitises a string so it can be safely used in a filename
+// It does not need to be injective, since we check for filename collisions.
+func sanitise(s string) string {
+	return replacer.Replace(s)
+}
+
 func openDiskFile(directory, username, extension string) (*os.File, error) {
 	filenameFormat := "2006-01-02T15:04:05.000"
 	if runtime.GOOS == "windows" {
@@ -251,7 +262,7 @@ func openDiskFile(directory, username, extension string) (*os.File, error) {
 
 	filename := time.Now().Format(filenameFormat)
 	if username != "" {
-		filename = filename + "-" + username
+		filename = filename + "-" + sanitise(username)
 	}
 	for counter := 0; counter < 100; counter++ {
 		var fn string

diskwriter/diskwriter_test.go

@@ -7,6 +7,22 @@ import (
 	"github.com/jech/galene/rtptime"
 )
 
+func TestSanitise(t *testing.T) {
+	tests := []struct{ a, b string }{
+		{"Alas", "Alas"},
+		{", poor Horatio", ", poor Horatio"},
+		{"I/knew\\him/well", "I-slash-knew-backslash-him-slash-well"},
+	}
+
+	for _, tt := range tests {
+		c := sanitise(tt.a)
+		if c != tt.b {
+			t.Errorf("sanitise(%v): got %v, expected %v",
+				tt.a, c, tt.b)
+		}
+	}
+}
+
 func TestAdjustOriginLocalNow(t *testing.T) {
 	now := time.Now()