expand forbidden chars

Author: emilykl

src/lib/slugify.js

@@ -2,7 +2,9 @@
 
 // precompile for speed
 var HTML_TAGS_REGEX = /<[^>]*>/g;                 // anything contained in < > tags
-var FORBIDDEN_CHARS_REGEX = /[\\/:*?"<>|$`'(){}[\],]/g; // Characters in the set: \/:*?"<>|$`'(){}[],
+var FORBIDDEN_CHARS_REGEX = /[\\/:*?"<>|$%&!@#~.^`'(){}[\],]/g; // Characters in the set: \/:*?"<>|$%&!@#~.^`'(){}[],
+var CONTROL_CHARS_REGEX = /\p{Cc}/gu; // Unicode control characters
+
 var UNICODE_REPLACEMENT_CHAR_REGEX = /�/g;        // U+FFFD, the Unicode replacement character
 var WHITESPACE_REGEX = /\s+/g;
 
@@ -37,14 +39,15 @@ function toWellFormed(str) {
  * @return {string}
  */
 module.exports = function slugify(str, maxLen = DEFAULT_MAX_LEN) {
-    var slug = toWellFormed(str ?? '')                // Guarantee well-formed Unicode text
-        .replace(UNICODE_REPLACEMENT_CHAR_REGEX, '')  // Drop Unicode replacement characters left by previous step
-        .replace(HTML_TAGS_REGEX, ' ')                // Remove anything contained in < > tags, such as <br> (replace with a space)
-        .replace(FORBIDDEN_CHARS_REGEX, '')           // Remove forbidden filename characters
-        .toLowerCase()                                // Lowercase everything
-        .trim()                                       // Strip leading/trailing whitespace
-        .replace(WHITESPACE_REGEX, WORD_SEP_CHAR)     // Replace any remaining whitespace with the word separator char
-        .replace(WORD_SEP_CHARS_REGEX, WORD_SEP_CHAR); // Replace multiple consecutive word separator chars with a single one
+    var slug = toWellFormed(str ?? '')                 // Guarantee well-formed Unicode text
+        .replace(UNICODE_REPLACEMENT_CHAR_REGEX, '')   // Drop Unicode replacement chars left by previous step
+        .replace(HTML_TAGS_REGEX, ' ')                 // Remove < > tags, such as <br> (replace with space)
+        .replace(FORBIDDEN_CHARS_REGEX, '')            // Remove forbidden filename characters
+        .toLowerCase()                                 // Lowercase everything
+        .trim()                                        // Strip leading/trailing whitespace
+        .replace(WHITESPACE_REGEX, WORD_SEP_CHAR)      // Replace any remaining whitespace with the word sep char
+        .replace(CONTROL_CHARS_REGEX, '')              // Remove control characters (after whitespace)
+        .replace(WORD_SEP_CHARS_REGEX, WORD_SEP_CHAR); // Replace multiple word sep chars with a single one
 
     if (slug.length <= maxLen) return slug;
     // Apply maxLen to the resulting string. Use Array.from().slice() instead of String.prototype.split()

test/jasmine/tests/download_test.js

@@ -115,7 +115,7 @@ describe('Plotly.downloadImage', function() {
         it('strips forbidden characters from the title', function(done) {
             downloadDefault({title: {text: 'Revenue, Costs & "Profit" (2024)'}})
             .then(function(filename) {
-                expect(filename).toBe('revenue-costs-&-profit-2024.png');
+                expect(filename).toBe('revenue-costs-profit-2024.png');
             })
             .then(done, done.fail);
         }, LONG_TIMEOUT_INTERVAL);

test/jasmine/tests/lib_test.js

@@ -1952,7 +1952,13 @@ describe('Test lib.js:', function () {
         });
 
         it('removes illegal filename characters', function () {
-            expect(Lib.slugify('a/b\\c:d*e?f"g|h$i')).toBe('abcdefghi');
+            expect(Lib.slugify('a/b\\c:d*e?f"g|h$i%j&k!l@m#n~o.p^q`r\'s,t'))
+                .toBe('abcdefghijklmnopqrst');
+            expect(Lib.slugify('a>b<c)d(e]f[g}h{i')).toBe('abcdefghi');
+        });
+
+        it('removes control characters', function () {
+            expect(Lib.slugify('a\x00b\x07c\x1Fd')).toBe('abcd');
         });
 
         it('preserves unicode letters (accents, CJK, emoji)', function () {