Repository: astropy/pyvo

Issue:
cachedataset hands through slashes in image titles to the file system
If a SIA service returns a slash as a part of an image title, SIARecord's cachedataset will fail with an error message that will be hard to understand, such as

```
FileNotFoundError: [Errno 2] No such file or directory: './ROSAT_HRI_ROSAT_Soft/Medium_X-Ray_1997-11-20_09:20:30.795013.fits'
```

The following code reproduces this at this point:

```
import pyvo

ACCESS_URL = "http://dc.zah.uni-heidelberg.de/rosat/q/im/siap.xml?"

svc = pyvo.sia.SIAService(ACCESS_URL)
images = svc.search((340.1,3.36), size=(0.1, 0.1))
images[0].cachedataset()
```

To fix this, we should defuse certain active characters in image_title.  This would be at least the slash and probably the backslash.  

Given there are several sorts of conceivable attacks when you expose various file systems to random strings from the internet, one could argue we should only let through characters between 32 and 127 inclusive, but I think we can by and large trust people who put up SIAP services.  If anyone argues we should not, this would be the opportunity to do *something* sensible with non-ascii here.

Discussion:

Patch:
diff --git a/CHANGES.rst b/CHANGES.rst
index f4d6699..56ffb21 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -6,6 +6,8 @@ Bug Fixes
 
 - cachedataset() and friends again produce reasonable file extensions.
   [#553]
+- path separators are no longer taken over from image titles to file
+  system paths. [#557]
 
 Enhancements and Fixes
 ----------------------
diff --git a/pyvo/dal/query.py b/pyvo/dal/query.py
index d86d104..66a8df4 100644
--- a/pyvo/dal/query.py
+++ b/pyvo/dal/query.py
@@ -894,6 +894,9 @@ class Record(Mapping):
         if not ext:
             ext = self.suggest_extension(default="dat")
 
+        base = base.replace("/", "_"
+            ).replace("\\", "_")
+
         # be efficient when writing a bunch of files into the same directory
         # in succession
         n = self._dsname_no


Test patch:
diff --git a/pyvo/dal/tests/test_sia.py b/pyvo/dal/tests/test_sia.py
index 07067bd..1e757a2 100644
--- a/pyvo/dal/tests/test_sia.py
+++ b/pyvo/dal/tests/test_sia.py
@@ -4,6 +4,7 @@
 Tests for pyvo.dal.sia
 """
 from functools import partial
+import os
 import re
 
 import pytest
@@ -90,3 +91,21 @@ class TestSIAService:
         assert service["FORMAT"] == "GRAPHIC-png"
         service.format = "Unsupported"
         assert service["FORMAT"] == "Unsupported"
+
+
+@pytest.mark.usefixtures('sia')
+class TestNameMaking:
+    def test_slash_replace(self):
+        res = SIAService('http://example.com/sia').search(pos=(288, 15))
+        res["imageTitle"][0] = "ogsa/dai output"
+        assert res[0].make_dataset_filename() == os.path.join(".", "ogsa_dai_output.fits")
+
+    def test_default_for_broken_media_type(self):
+        res = SIAService('http://example.com/sia').search(pos=(288, 15))
+        res["mime"][0] = "application/x-youcannotknowthis"
+        assert res[0].make_dataset_filename() == os.path.join(".", "Test_Observation.dat")
+
+    def test_default_media_type_adaption(self):
+        res = SIAService('http://example.com/sia').search(pos=(288, 15))
+        res["mime"][0] = "image/png"
+        assert res[0].make_dataset_filename() == os.path.join(".", "Test_Observation.png")