'Uploaded file names should be sanitized before ever reaching the view.'

def test_dangerous_file_names(self):

    scary_file_names = [u'/tmp/hax0rd.txt', u'C:\\Windows\\hax0rd.txt', u'C:/Windows/hax0rd.txt', u'\\tmp\\hax0rd.txt', u'/tmp\\hax0rd.txt', u'subdir/hax0rd.txt', u'subdir\\hax0rd.txt', u'sub/dir\\hax0rd.txt', u'../../hax0rd.txt', u'..\\..\\hax0rd.txt', u'../..\\hax0rd.txt']
    payload = client.FakePayload()
    for (i, name) in enumerate(scary_file_names):
        payload.write(u'\r\n'.join([(u'--' + client.BOUNDARY), (u'Content-Disposition:    form-data;    name="file%s";    filename="%s"' % (i, name)), u'Content-Type:    application/octet-stream', u'', u'You    got    pwnd.\r\n']))
    payload.write(((u'\r\n--' + client.BOUNDARY) + u'--\r\n'))
    r = {u'CONTENT_LENGTH': len(payload), u'CONTENT_TYPE': client.MULTIPART_CONTENT, u'PATH_INFO': u'/file_uploads/echo/', u'REQUEST_METHOD': u'POST', u'wsgi.input': payload}
    response = self.client.request(**r)
    recieved = json.loads(response.content.decode(u'utf-8'))
    for (i, name) in enumerate(scary_file_names):
        got = recieved[(u'file%s' % i)]
        self.assertEqual(got, u'hax0rd.txt')
