From 25d2a201a998b7da404063f3ba3d03257879b509 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Tue, 3 Nov 2026 23:49:12 -0500
Subject: [PATCH] fix(server): clean a published file's name when it is taken
 from the file (#1978)

---
 apps/figcraft-server/src/admin_budget_tests.rs | 8 ++++++++
 apps/figcraft-server/src/store/files.rs        | 3 ++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/apps/figcraft-server/src/admin_budget_tests.rs b/apps/figcraft-server/src/admin_budget_tests.rs
index 71c62897c..10acdabff 100644
--- a/apps/figcraft-server/src/admin_budget_tests.rs
+++ b/apps/figcraft-server/src/admin_budget_tests.rs
@@ -75,3 +75,11 @@ fn codes_are_found_through_the_index_as_before() {
     assert_eq!(store.resolve_code(who(105), &codes[2]).unwrap_err(), CODE_GONE);
     assert_eq!(store.resolve_code(who(106), &codes[3]).unwrap().0, files[3].0);
 }
+
+#[test]
+fn a_name_taken_from_the_file_is_cleaned_like_a_given_one() {
+    let dir = TempDir::new("embedded-name");
+    let mut store = Store::open(dir.path(), config(dir.path()).store()).unwrap();
+    let (file, ..) = store.publish("", &snapshot("Bad\u{1b}[2Jname\u{202E}")).unwrap();
+    assert_eq!(file.name, "Bad[2Jname");
+}
diff --git a/apps/figcraft-server/src/store/files.rs b/apps/figcraft-server/src/store/files.rs
index dba351861..fcc0fd109 100644
--- a/apps/figcraft-server/src/store/files.rs
+++ b/apps/figcraft-server/src/store/files.rs
@@ -95,8 +95,9 @@ impl Store {
             return Err(format!("the file has more than {} layers", self.cfg.core.max_nodes));
         }
         let mut doc = replica.document().clone();
+        // The name the file keeps, whichever one it comes from, is cleaned.
         let name = match clean_name(name) {
-            n if n.is_empty() => doc.name.clone(),
+            n if n.is_empty() => clean_name(&doc.name),
             n => n,
         };
         doc.name = name.clone();