FIX: only allow printable characters in uploads filename

lib/upload_creator.rb

@@ -22,8 +22,8 @@ class UploadCreator
   #  - for_export (boolean)
   def initialize(file, filename, opts = {})
     @file = file
-    @filename = filename || ''
-    @upload = Upload.new(original_filename: filename, filesize: 0)
+    @filename = (filename || "").gsub(/[^[:print:]]/, "")
+    @upload = Upload.new(original_filename: @filename, filesize: 0)
     @opts = opts
   end
 

spec/lib/upload_creator_spec.rb

@@ -14,7 +14,7 @@ RSpec.describe UploadCreator do
 
       it 'should store the upload with the right extension' do
         expect do
-          UploadCreator.new(file, filename).create_for(user.id)
+          UploadCreator.new(file, "utf-8\n.txt").create_for(user.id)
         end.to change { Upload.count }.by(1)
 
         upload = Upload.last