'Uploaded file names should be sanitized before ever reaching the view.'

def test_dangerous_file_names(self):

    scary_file_names = ['/tmp/hax0rd.txt', 'C:\\Windows\\hax0rd.txt', 'C:/Windows/hax0rd.txt', '\\tmp\\hax0rd.txt', '/tmp\\hax0rd.txt', 'subdir/hax0rd.txt', 'subdir\\hax0rd.txt', 'sub/dir\\hax0rd.txt', '../../hax0rd.txt', '..\\..\\hax0rd.txt', '../..\\hax0rd.txt']
    payload = []
    for (i, name) in enumerate(scary_file_names):
        payload.extend([('--' + client.BOUNDARY), ('Content-Disposition:    form-data;    name="file%s";    filename="%s"' % (i, name)), 'Content-Type:    application/octet-stream', '', 'You    got    pwnd.'])
    payload.extend([(('--' + client.BOUNDARY) + '--'), ''])
    payload = '\r\n'.join(payload)
    r = {'CONTENT_LENGTH': len(payload), 'CONTENT_TYPE': client.MULTIPART_CONTENT, 'PATH_INFO': '/file_uploads/echo/', 'REQUEST_METHOD': 'POST', 'wsgi.input': client.FakePayload(payload)}
    response = self.client.request(**r)
    recieved = simplejson.loads(response.content)
    for (i, name) in enumerate(scary_file_names):
        got = recieved[('file%s' % i)]
        self.assertEqual(got, 'hax0rd.txt')
