Filename sanitization optimized to remove any leftover dot prefix

Author: Webklex

src/Attachment.php

@@ -324,13 +324,17 @@ public function decodeName(?string $name): string {
             }
 
             // sanitize $name
-            // order of '..' is important
             $replaces = [
                 '/\\\\/' => '',
                 '/[\/\0:]+/' => '',
                 '/\.+/' => '.',
             ];
-            return preg_replace(array_keys($replaces), array_values($replaces), $name);
+            $name_starts_with_dots = str_starts_with($name, '..');
+            $name = preg_replace(array_keys($replaces), array_values($replaces), $name);
+            if($name_starts_with_dots) {
+                return substr($name, 1);
+            }
+            return $name;
         }
         return "";
     }

tests/AttachmentTest.php

@@ -28,7 +28,7 @@ public function testDecodeName(string $input, string $output): void
     public function decodeNameDataProvider(): array
     {
         return [
-            ['../../../../../../../../../../../var/www/shell.php', '.varwwwshell.php'],
+            ['../../../../../../../../../../../var/www/shell.php', 'varwwwshell.php'],
             ['test..xml', 'test.xml'],
             [chr(0), ''],
             ['C:\\file.txt', 'Cfile.txt'],