From 676f017ec0c0ffa80126ddaf781159c96f719df5 Mon Sep 17 00:00:00 2001
From: Ivan Dyachkov <dev@dyachkov.org>
Date: Mon, 16 Jan 2023 14:02:16 +0100
Subject: [PATCH] fix: ensure no colon in filenames

---
 apps/emqx/src/emqx_authentication_config.erl    |  4 ++--
 apps/emqx/src/emqx_misc.erl                     | 11 ++++++++++-
 apps/emqx_bridge/src/emqx_bridge_resource.erl   |  3 ++-
 apps/emqx_resource/src/emqx_resource_worker.erl |  5 +++--
 4 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/apps/emqx/src/emqx_authentication_config.erl b/apps/emqx/src/emqx_authentication_config.erl
index 98471e152..300fb4a66 100644
--- a/apps/emqx/src/emqx_authentication_config.erl
+++ b/apps/emqx/src/emqx_authentication_config.erl
@@ -327,9 +327,9 @@ atom(Bin) -> binary_to_existing_atom(Bin, utf8).
 certs_dir(ChainName, ConfigOrID) ->
     DirName = dir(ChainName, ConfigOrID),
     SubDir = iolist_to_binary(filename:join(["authn", DirName])),
-    binary:replace(SubDir, <<":">>, <<"-">>, [global]).
+    emqx_misc:safe_filename(SubDir).
 
 dir(ChainName, ID) when is_binary(ID) ->
-    binary:replace(iolist_to_binary([to_bin(ChainName), "-", ID]), <<":">>, <<"-">>);
+    emqx_misc:safe_filename(iolist_to_binary([to_bin(ChainName), "-", ID]));
 dir(ChainName, Config) when is_map(Config) ->
     dir(ChainName, authenticator_id(Config)).
diff --git a/apps/emqx/src/emqx_misc.erl b/apps/emqx/src/emqx_misc.erl
index 483b99587..c20227c07 100644
--- a/apps/emqx/src/emqx_misc.erl
+++ b/apps/emqx/src/emqx_misc.erl
@@ -55,7 +55,8 @@
     readable_error_msg/1,
     safe_to_existing_atom/1,
     safe_to_existing_atom/2,
-    pub_props_to_packet/1
+    pub_props_to_packet/1,
+    safe_filename/1
 ]).
 
 -export([
@@ -708,3 +709,11 @@ pub_props_to_packet(Properties) ->
             true
     end,
     maps:filtermap(F, Properties).
+
+%% fix filename by replacing characters which could be invalid on some filesystems
+%% with safe ones
+-spec safe_filename(binary() | unicode:chardata()) -> binary() | [unicode:chardata()].
+safe_filename(Filename) when is_binary(Filename) ->
+    binary:replace(Filename, <<":">>, <<"-">>, [global]);
+safe_filename(Filename) when is_list(Filename) ->
+    string:replace(Filename, ":", "-", all).
diff --git a/apps/emqx_bridge/src/emqx_bridge_resource.erl b/apps/emqx_bridge/src/emqx_bridge_resource.erl
index 4f8d248b2..b916a0fbe 100644
--- a/apps/emqx_bridge/src/emqx_bridge_resource.erl
+++ b/apps/emqx_bridge/src/emqx_bridge_resource.erl
@@ -216,7 +216,8 @@ recreate(Type, Name, Conf, Opts) ->
     ).
 
 create_dry_run(Type, Conf0) ->
-    TmpPath = iolist_to_binary(["bridges-create-dry-run:", emqx_misc:gen_id(8)]),
+    TmpPath0 = iolist_to_binary(["bridges-create-dry-run:", emqx_misc:gen_id(8)]),
+    TmpPath = emqx_misc:safe_filename(TmpPath0),
     Conf = emqx_map_lib:safe_atom_key_map(Conf0),
     case emqx_connector_ssl:convert_certs(TmpPath, Conf) of
         {error, Reason} ->
diff --git a/apps/emqx_resource/src/emqx_resource_worker.erl b/apps/emqx_resource/src/emqx_resource_worker.erl
index 7840fd474..697d5a84b 100644
--- a/apps/emqx_resource/src/emqx_resource_worker.erl
+++ b/apps/emqx_resource/src/emqx_resource_worker.erl
@@ -871,8 +871,9 @@ queue_count(Q) ->
     replayq:count(Q).
 
 disk_queue_dir(Id, Index) ->
-    QDir = binary_to_list(Id) ++ ":" ++ integer_to_list(Index),
-    filename:join([emqx:data_dir(), "resource_worker", node(), QDir]).
+    QDir0 = binary_to_list(Id) ++ ":" ++ integer_to_list(Index),
+    QDir = filename:join([emqx:data_dir(), "resource_worker", node(), QDir0]),
+    emqx_misc:safe_filename(QDir).
 
 ensure_flush_timer(Data = #{tref := undefined, batch_time := T}) ->
     Ref = make_ref(),