Sanitize msgid before using it as savename

Before using the msgid as part of the filename, clean it up to only
contains sensible characters.

Reported-by: Rob Herring <robherring2@gmail.com>
Signed-off-by: Konstantin Ryabitsev <konstantin@linuxfoundation.org>

1 files changed, 2 insertions, 1 deletions

diff --git a/b4/mbox.py b/b4/mbox.py
index f575f94..3d887e6 100644
--- a/b4/mbox.py
+++ b/b4/mbox.py
@@ -656,7 +656,8 @@ def main(cmdargs):
     if cmdargs.wantname:
         savename = os.path.join(cmdargs.outdir, cmdargs.wantname)
     else:
-        savename = os.path.join(cmdargs.outdir, f'{msgid}.{dftext}')
+        safe_msgid = re.sub(r'[^\w@.+%-]+', '_', msgid).strip('_')
+        savename = os.path.join(cmdargs.outdir, f'{safe_msgid}.{dftext}')
 
     if save_maildir:
         if os.path.isdir(savename):