'Uploaded file names should be sanitized before ever reaching the view.'

def test_dangerous_file_names(self):

    scary_file_names = ['/tmp/hax0rd.txt', 'C:\\Windows\\hax0rd.txt', 'C:/Windows/hax0rd.txt', '\\tmp\\hax0rd.txt', '/tmp\\hax0rd.txt', 'subdir/hax0rd.txt', 'subdir\\hax0rd.txt', 'sub/dir\\hax0rd.txt', '../../hax0rd.txt', '..\\..\\hax0rd.txt', '../..\\hax0rd.txt']
    payload = client.FakePayload()
    for (i, name) in enumerate(scary_file_names):
        payload.write('\r\n'.join([('--' + client.BOUNDARY), ('Content-Disposition:    form-data;    name="file%s";    filename="%s"' % (i, name)), 'Content-Type:    application/octet-stream', '', 'You    got    pwnd.\r\n']))
    payload.write((('\r\n--' + client.BOUNDARY) + '--\r\n'))
    r = {'CONTENT_LENGTH': len(payload), 'CONTENT_TYPE': client.MULTIPART_CONTENT, 'PATH_INFO': '/echo/', 'REQUEST_METHOD': 'POST', 'wsgi.input': payload}
    response = self.client.request(**r)
    received = response.json()
    for (i, name) in enumerate(scary_file_names):
        got = received[('file%s' % i)]
        self.assertEqual(got, 'hax0rd.txt')
