
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
reasonable-filename
Advanced tools
A simple JavaScript/TypeScript utility to reasonably validate file and folder names.
# NPM
npm install reasonable-filename
# Yarn
yarn add reasonable-filename
# Bun???
bun add reasonable-filename
import isReasonableFilename from 'reasonable-filename'
console.log(isReasonableFilename('file.c')) // true
console.log(isReasonableFilename('LPT2.tar.gz')) // false (invalid on Windows)
// If you want to access the regex directly...
// This doesn't do length checks.
import { unreasonableFilenameRegex } from 'reasonable-filename'
console.log(!unreasonableFilenameRegex.test('file.c')) // true
valid-filename by sindresorhus?valid-filename doesn't, for example, Windows reserved keywords with extensionsCOM0 and LPT0Sure, this is less popular, but even if I die and stop providing support, reasonable-filename is small enough that you can easily copy it into your project.
I love you sindresorhus!
. (this also rules out . and .. as names)\/:*?"<>|., with trailing whitespace trimmed, cannot case-insensitively match a Windows reserved keyword such as CON and LPT2Filenames are super weird. Different platforms have different requirements, with Windows being the strictest. Windows in particular is a backwards compatibilty behemoth with a lot of strange reserved names. As such, it's impossible to create a perfect test of filename compatibility on every platform.
This package gets as close as I can. It can't provide any security guarantees beyond what is specified under Rules above, but but it will help validate most cases.
Spot a rule we're missing or a mistake in the current ruleset? Feel free to submit a PR or issue! I will review everything in less than 24 hours from issue or pull request submission.
FAQs
Reasonably validate file and folder names
The npm package reasonable-filename receives a total of 26 weekly downloads. As such, reasonable-filename popularity was classified as not popular.
We found that reasonable-filename demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.