I thinks it's fair to allow 0-9 only.
I'll try what happens if I specify `%999d`


On Mon, Mar 18, 2013 at 1:43 PM, Ryan Morlok <notifications@github.com>wrote:

> In src/util/path.cc:
>
> > +            {
> > +                sanitized.push_back('%');
> > +                sanitized.push_back('%');
> > +            }
> > +            else
> > +            {
> > +                // We haven't found the format specifier yet, so see if we can use this one as a valid formatter
> > +                size_t original_i = i;
> > +                string tmp;
> > +                tmp.push_back('%');
> > +                while(++i < filename.size())
> > +                {
> > +                    tmp.push_back(filename[i]);
> > +
> > +                    // If we aren't still in option specifiers, stop looking
> > +                    if(!strchr("+-#0123456789.", filename[i]))
>
> You are correct, it does allow for some invalid format specifiers to get
> through (so does gnuplot). The challenge is that without regex, if you
> truly want to model the syntax for format specifiers, you need to
> explicitly encode the languages's state machine.
>
> One option would be to remove some of the formatting options, eg only
> allow 0-9.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/coolwanglu/pdf2htmlEX/pull/98/files#r3407890>
> .
>