Confirm Before Opening Program Attachments and Load Only HTTPS Images

Opening a project attachment whose type runs as a program or script (executables, installers, shortcuts, shell and PowerShell scripts, macOS command files and apps, Linux desktop entries) now asks for confirmation first. The check lives in libslic3r as is_executable_file_name and ignores the trailing dots and spaces Windows strips from file names. Images in project descriptions are kept only when they load over https, so opening the Project tab no longer issues plain-http requests.
Tighten Project Page Description Rendering and Keep More Formatting
2026-09-29 03:41:31 +00:00 · 2026-09-28 17:05:29 +08:00 · 2026-09-28 15:23:31 +08:00 · 2026-09-28 05:56:10 +08:00
7 changed files with 316 additions and 246 deletions
@@ -214,9 +214,9 @@ function ShowModelInfo( pModel )
 	
 	SendWXDebugInfo("Model Name:  "+sModelName);
 	
-	$('#ModelName').html(sModelName);
+	$('#ModelName').text(sModelName);
 	$('#ModelName').attr('title',sModelName);
-    $('#ModelAuthorName').html(sModelAuthor);
+    $('#ModelAuthorName').text(sModelAuthor);
 	
 	switch(UploadType)
 	{
@@ -268,7 +268,7 @@ function ShowModelInfo( pModel )
 			break;
 	}
 	
-	$('#Model_Desc').html( html_decode(sModelDesc) );
+	$('#Model_Desc').empty().append( SanitizeDescHtml( html_decode(sModelDesc) ) );
 			
 	let ModelPreviewList=pModel.preview_img;				
    let TotalPreview=ModelPreviewList.length;
@@ -281,16 +281,15 @@ function ShowModelInfo( pModel )
 	
    if(TotalPreview>0)
 	{
-		let htmlPreview='';
+		$('#ModelPreviewList').empty();
 		for(let pn=0;pn<TotalPreview;pn++)			
 		{	
 			//let FTmpPath=decodeURIComponent(ModelPreviewList[pn]);
 			let FTmpPath=ModelPreviewList[pn]['filepath'];
 			
-			htmlPreview+='<div class="swiper-slide"><img class="Model_PrevImg" src="'+FTmpPath+'" /></div>';
+			$('#ModelPreviewList').append( $('<div class="swiper-slide"></div>').append( $('<img class="Model_PrevImg" />').attr('src',FTmpPath) ) );
 		}
 			
-	    $('#ModelPreviewList').html(htmlPreview);
 		$('#Model_Preview_Image').viewer({
 			title: false,
 		    fullsreen: false,
@@ -410,7 +409,8 @@ function ConstructFileHtml( ID, pItem )
 {
 	let fTotal=pItem.length;
 	
-	let strHtml='';
+	let pBoard=$('#'+ID+'  .FileListBoard');
+	pBoard.empty();
 	for( let f=0;f<fTotal;f++ )
 	{
 		let pOne=pItem[f];
@@ -443,39 +443,139 @@ function ConstructFileHtml( ID, pItem )
 			ImgPath='img/default.png';			
 		}		
 			
-		//Add html
+		//Add html. File names come from the 3MF, so build the nodes rather than concatenating markup.
+		let pIconImg=$('<img />').attr('src',ImgPath);
+		let pMenu=$('<div class="FileMenu"><img src="img/s.svg" /></div>');
 		if( strClass!='ImageIcon' )
 		{
-		strHtml+='<div class="FileItem">'+
-				 '	<div class="'+strClass+'"><img src="'+ImgPath+'" /></div>'+
-				 '	<div class="FileText">'+
-			     '		<div class="FileName">'+tName+'</div>'+
-				 '	</div>'+
-				 '	<div class="FileMenu" onClick="OnClickOpenFile(\''+tPath+'\')"><img src="img/s.svg" /></div>'+
-				 '</div>';
+			pMenu.on('click', function(){ OnClickOpenFile(tPath); });
 		}
 		else
 		{
 			ImgID++;
 			let TmpImgID="AF"+ImgID;
 			
-		strHtml+='<div class="FileItem">'+
-				 '	<div class="'+strClass+'"><img id="'+TmpImgID+'" src="'+ImgPath+'" /></div>'+
-				 '	<div class="FileText">'+
-			     '		<div class="FileName">'+tName+'</div>'+
-				 '	</div>'+
-				 '	<div class="FileMenu" onClick="OnClickOpenImage(\''+TmpImgID+'\')"><img src="img/s.svg" /></div>'+
-				 '</div>';			
+			pIconImg.attr('id',TmpImgID);
+			pMenu.on('click', function(){ OnClickOpenImage(TmpImgID); });
 		}
+		
+		let pFileItem=$('<div class="FileItem"></div>');
+		pFileItem.append( $('<div></div>').addClass(strClass).append(pIconImg) );
+		pFileItem.append( $('<div class="FileText"></div>').append( $('<div class="FileName"></div>').text(tName).attr('title',tName) ) );
+		pFileItem.append( pMenu );
+		pBoard.append( pFileItem );
 	}
 	
-	$('#'+ID+'  .FileListBoard').html(strHtml);
-	
    if( fTotal>0 )
 		$('#'+ID).show();
 }


+// Descriptions are untrusted 3MF metadata that may carry rich-text HTML (e.g. from MakerWorld).
+// Rebuild them from an inert parse, keeping only plain formatting tags and http(s) links and images.
+var DescAllowedTags=['P','BR','B','STRONG','I','EM','U','S','STRIKE','DEL','INS','SUB','SUP','SMALL','MARK',
+	'Q','ABBR','KBD','WBR','H1','H2','H3','H4','H5','H6','UL','OL','LI','DL','DT','DD','BLOCKQUOTE','PRE','CODE',
+	'HR','SPAN','DIV','FIGURE','FIGCAPTION','TABLE','CAPTION','THEAD','TBODY','TFOOT','TR','TH','TD','A','IMG'];
+// Plain attributes kept per tag; the numeric ones must be plain non-negative integers.
+var DescAllowedAttrs={'IMG':['alt','title','width','height'],'TD':['colspan','rowspan'],'TH':['colspan','rowspan'],'OL':['start']};
+var DescNumericAttrs=['width','height','colspan','rowspan','start'];
+// Dropped together with their content; any other unknown tag is unwrapped to its children.
+var DescDroppedTags=['SCRIPT','STYLE','TEMPLATE','NOSCRIPT','TEXTAREA','TITLE','IFRAME','FRAME','OBJECT','EMBED','SVG','MATH'];
+
+function IsHttpUrl( strUrl )
+{
+	// The scheme must be written as is, so nothing the URL parser would strip can precede or split it.
+	if( typeof strUrl!='string' || !/^https?:/i.test(strUrl) )
+		return false;
+	try
+	{
+		let sProtocol=new URL(strUrl).protocol;
+		return sProtocol=='http:' || sProtocol=='https:';
+	}
+	catch(e)
+	{
+		return false;
+	}
+}
+
+// Images load as soon as the page opens, so only https sources are kept: no plain-http requests to the local network.
+function IsHttpsUrl( strUrl )
+{
+	return IsHttpUrl(strUrl) && new URL(strUrl).protocol=='https:';
+}
+
+// Embedded YouTube players become a plain link to the video.
+function GetYouTubeEmbedUrl( pNode )
+{
+	let sSrc=pNode.getAttribute('src');
+	if( !IsHttpUrl(sSrc) )
+		return null;
+	let pUrl=new URL(sSrc);
+	return ( pUrl.origin=='https://www.youtube.com' && pUrl.pathname.indexOf('/embed/')==0 ) ? pUrl.href : null;
+}
+
+function CopyDescNodes( pSrc, pDst )
+{
+	for( let pNode=pSrc.firstChild;pNode!=null;pNode=pNode.nextSibling )
+	{
+		if( pNode.nodeType==Node.TEXT_NODE )
+		{
+			pDst.appendChild( document.createTextNode(pNode.nodeValue) );
+			continue;
+		}
+		if( pNode.nodeType!=Node.ELEMENT_NODE )
+			continue;
+		
+		let sTag=pNode.nodeName.toUpperCase();
+		if( sTag=='IFRAME' )
+		{
+			let sVideoUrl=GetYouTubeEmbedUrl(pNode);
+			if( sVideoUrl!=null )
+			{
+				let pLink=document.createElement('A');
+				pLink.setAttribute('href',sVideoUrl);
+				pLink.textContent=sVideoUrl;
+				pDst.appendChild(pLink);
+			}
+			continue;
+		}
+		if( $.inArray(sTag,DescDroppedTags)>=0 )
+			continue;
+		if( $.inArray(sTag,DescAllowedTags)<0 )
+		{
+			CopyDescNodes(pNode,pDst);
+			continue;
+		}
+		
+		let pElem=document.createElement(sTag);
+		if( sTag=='A' && IsHttpUrl(pNode.getAttribute('href')) )
+			pElem.setAttribute('href',pNode.getAttribute('href'));
+		else if( sTag=='IMG' )
+		{
+			if( !IsHttpsUrl(pNode.getAttribute('src')) )
+				continue;
+			pElem.setAttribute('src',pNode.getAttribute('src'));
+		}
+		$.each( DescAllowedAttrs[sTag]||[], function(i,sAttr){
+			let sValue=pNode.getAttribute(sAttr);
+			if( sValue!=null && ( $.inArray(sAttr,DescNumericAttrs)<0 || /^\d+$/.test(sValue) ) )
+				pElem.setAttribute(sAttr,sValue);
+		});
+		CopyDescNodes(pNode,pElem);
+		pDst.appendChild(pElem);
+	}
+}
+
+function SanitizeDescHtml( strHtml )
+{
+	let pFragment=document.createDocumentFragment();
+	// A DOMParser document is inert: it runs no scripts and loads no resources.
+	let pDoc=new DOMParser().parseFromString(strHtml,'text/html');
+	if( pDoc && pDoc.body )
+		CopyDescNodes(pDoc.body,pFragment);
+	return pFragment;
+}
+
 function ShowProfilelInfo( pProfile )
 {
 	//==========Profile Info==========
@@ -483,10 +583,10 @@ function ShowProfilelInfo( pProfile )
 	let sProfileAuthor=decodeURIComponent(pProfile.author);
 	let sProfileDesc=decodeURIComponent(pProfile.description);
 	
-	$('#ProfileName').html(sProfileName);
-    $('#ProfileAuthor').html(sProfileAuthor);
+	$('#ProfileName').text(sProfileName);
+    $('#ProfileAuthor').text(sProfileAuthor);
 		
-	$('#Profile_Desc').html( html_decode(sProfileDesc) );
+	$('#Profile_Desc').empty().append( SanitizeDescHtml( html_decode(sProfileDesc) ) );
 			
 	let ProfilePreviewList=pProfile.preview_img;				
    let TotalPreview=ProfilePreviewList.length;
@@ -499,15 +599,14 @@ function ShowProfilelInfo( pProfile )
 	
    if(TotalPreview>0)
 	{
-		let htmlPreview='';
+		$('#ProfilePreviewList').empty();
 		for(let pn=0;pn<TotalPreview;pn++)			
 		{	
 			let FTmpPath=ProfilePreviewList[pn]['filepath'];
 			
-			htmlPreview+='<div class="swiper-slide"><img class="Model_PrevImg" src="'+FTmpPath+'" /></div>';
+			$('#ProfilePreviewList').append( $('<div class="swiper-slide"></div>').append( $('<img class="Model_PrevImg" />').attr('src',FTmpPath) ) );
 		}
 			
-		$('#ProfilePreviewList').html(htmlPreview);
 		$('#Profile_Preview_Image').viewer({
 			title: false,
 		    fullsreen: false,
@@ -260,6 +260,11 @@ extern bool is_json_file(const std::string& path);
 // Both '/' and '\\' are treated as separators on every platform, so an archive rejected on one OS
 // is rejected on all of them.
 extern bool is_path_within_root(const std::string &rel_path, const boost::filesystem::path &root);
+// True if path names an entry strictly inside root: it must be spelled with root as its prefix,
+// and must still resolve inside root once symlinks are followed.
+extern bool is_absolute_path_within_root(const boost::filesystem::path &path, const boost::filesystem::path &root);
+// True if opening a file with this name through the desktop would run it as a program or script.
+extern bool is_executable_file_name(const std::string &file_name);

 // Orca: custom protocal support utils
 inline bool is_orca_open(const std::string& url) { return boost::starts_with(url, "orcaslicer://open"); }
@@ -285,21 +290,6 @@ inline std::string sanitize_filename(const std::string &filename){
    const std::regex special_chars("[/\\\\:*?\"<>|]");
    return std::regex_replace(filename, special_chars, "_");
 }
-// Reduce an untrusted, possibly path-qualified name to a single sanitized file name.
-// Returns an empty string when nothing usable remains.
-inline std::string sanitize_file_basename(const std::string &name){
-    const size_t sep = name.find_last_of("/\\");
-    const std::string base = sanitize_filename(sep == std::string::npos ? name : name.substr(sep + 1));
-    // Names made only of dots and spaces refer to the folder or its parent, or are stripped to nothing on Windows.
-    return base.find_first_not_of(". ") == std::string::npos ? std::string() : base;
-}
-// Marker file a download of this process writes to before it is renamed to filename.
-boost::filesystem::path download_marker_path(const boost::filesystem::path &dest_folder, const std::string &filename);
-// Finds a sanitized variant of filename, "name(N).ext" if needed, that neither an entry of dest_folder
-// nor the download marker of another download uses. The marker at ignored_marker does not count.
-// Returns true and the name in result, or false and the last name tried.
-bool find_unused_filename(const boost::filesystem::path &dest_folder, const std::string &filename,
-                          const boost::filesystem::path &ignored_marker, std::string &result);
 // File path / name / extension splitting utilities, working with UTF-8,
 // to be published to Perl.
 namespace PerlUtils {
@@ -70,6 +70,7 @@
 #include <boost/shared_ptr.hpp>

 #include <boost/algorithm/string/predicate.hpp>
+#include <boost/algorithm/string/case_conv.hpp>
 #include <boost/filesystem.hpp>
 #include <boost/filesystem/path.hpp>
 #include <boost/nowide/fstream.hpp>
@@ -1112,6 +1113,34 @@ bool is_path_within_root(const std::string &rel_path, const boost::filesystem::p
    }
 }

+bool is_absolute_path_within_root(const boost::filesystem::path &path, const boost::filesystem::path &root)
+{
+    const boost::filesystem::path rel = path.lexically_relative(root);
+    return !rel.empty() && rel != "." && is_path_within_root(rel.string(), root);
+}
+
+bool is_executable_file_name(const std::string &file_name)
+{
+    static const std::vector<std::string> executable_extensions = {
+        // Windows
+        "exe", "com", "bat", "cmd", "scr", "pif", "msi", "msp", "msc", "cpl", "lnk", "url", "hta", "js", "jse", "vbs",
+        "vbe", "wsf", "wsh", "ps1", "psm1", "reg", "jar", "appref-ms", "scf", "inf", "py", "pyw",
+        // macOS
+        "app", "command", "pkg", "terminal", "workflow",
+        // Linux
+        "sh", "bash", "run", "desktop", "appimage"};
+    // Windows ignores trailing dots and spaces, so "setup.exe." still runs as an .exe.
+    const size_t end = file_name.find_last_not_of(". ");
+    if (end == std::string::npos)
+        return false;
+    const std::string name = file_name.substr(0, end + 1);
+    const size_t      dot  = name.find_last_of('.');
+    if (dot == std::string::npos || name.find_first_of("/\\", dot) != std::string::npos)
+        return false;
+    const std::string extension = boost::algorithm::to_lower_copy(name.substr(dot + 1));
+    return std::find(executable_extensions.begin(), executable_extensions.end(), extension) != executable_extensions.end();
+}
+
 bool is_img_file(const std::string &path)
 {
 	return boost::iends_with(path, ".png") || boost::iends_with(path, ".svg");
@@ -1321,31 +1350,6 @@ unsigned get_current_pid()
 #endif
 }

-boost::filesystem::path download_marker_path(const boost::filesystem::path &dest_folder, const std::string &filename)
-{
-    return dest_folder / (filename + "." + std::to_string(get_current_pid()) + ".download");
-}
-
-bool find_unused_filename(const boost::filesystem::path &dest_folder, const std::string &filename,
-                          const boost::filesystem::path &ignored_marker, std::string &result)
-{
-    // Probe the name that will be written, so a name the sanitizing maps onto an existing file is versioned too.
-    const std::string sanitized = sanitize_filename(filename);
-    const std::string extension = boost::filesystem::path(sanitized).extension().string();
-    const std::string stem      = sanitized.substr(0, sanitized.size() - extension.size());
-    auto is_used = [&](const std::string &name) {
-        const boost::filesystem::path marker = download_marker_path(dest_folder, name);
-        return boost::filesystem::exists(dest_folder / name) || (marker != ignored_marker && boost::filesystem::exists(marker));
-    };
-    result = sanitized;
-    for (size_t version = 1; is_used(result); ++version) {
-        if (version > 999)
-            return false;
-        result = stem + "(" + std::to_string(version) + ")" + extension;
-    }
-    return true;
-}
-
 std::string per_user_temp_id()
 {
 #ifdef WIN32
@@ -71,6 +71,17 @@ bool FileGet::is_subdomain(const std::string& url, const std::string& domain)
 	return false;
 }

+namespace {
+unsigned get_current_pid()
+{
+#ifdef WIN32
+	return GetCurrentProcessId();
+#else
+	return ::getpid();
+#endif
+}
+}
+
 // int = DOWNLOAD ID; string = file path
 wxDEFINE_EVENT(EVT_DWNLDR_FILE_COMPLETE, wxCommandEvent);
 // int = DOWNLOAD ID; string = error msg
@@ -133,10 +144,25 @@ void FileGet::priv::get_perform()
 	std::string extension;
 	if (m_written == 0)
 	{
-		std::string final_filename;
-		bool found = false;
+		boost::filesystem::path dest_path = m_dest_folder / m_filename;
+		extension = dest_path.extension().string();
+		std::string just_filename = m_filename.substr(0, m_filename.size() - extension.size());
+		std::string final_filename = just_filename;
+        // Find unsed filename 
 		try {
-			found = find_unused_filename(m_dest_folder, m_filename, m_tmp_path, final_filename);
+			size_t version = 0;
+			while (boost::filesystem::exists(m_dest_folder / (final_filename + extension)) || boost::filesystem::exists(m_dest_folder / (final_filename + extension + "." + std::to_string(get_current_pid()) + ".download")))
+			{
+				++version;
+				if (version > 999) {
+					wxCommandEvent* evt = new wxCommandEvent(EVT_DWNLDR_FILE_ERROR);
+					evt->SetString(GUI::format_wxstr(L"Failed to find suitable filename. Last name: %1%." , (m_dest_folder / (final_filename + extension)).string()));
+					evt->SetInt(m_id);
+					m_evt_handler->QueueEvent(evt);
+					return;
+				}
+				final_filename = GUI::format("%1%(%2%)", just_filename, std::to_string(version));
+			}
 		} catch (const boost::filesystem::filesystem_error& e)
 		{
 			wxCommandEvent* evt = new wxCommandEvent(EVT_DWNLDR_FILE_ERROR);
@@ -145,18 +171,10 @@ void FileGet::priv::get_perform()
 			m_evt_handler->QueueEvent(evt);
 			return;
 		}
-		if (!found) {
-			wxCommandEvent* evt = new wxCommandEvent(EVT_DWNLDR_FILE_ERROR);
-			evt->SetString(GUI::format_wxstr(L"Failed to find suitable filename. Last name: %1%." , (m_dest_folder / final_filename).string()));
-			evt->SetInt(m_id);
-			m_evt_handler->QueueEvent(evt);
-			return;
-		}

-        m_filename = final_filename;
-		extension = boost::filesystem::path(m_filename).extension().string();
+        m_filename = sanitize_filename(final_filename + extension);

-        m_tmp_path = download_marker_path(m_dest_folder, m_filename);
+        m_tmp_path = m_dest_folder / (m_filename + "." + std::to_string(get_current_pid()) + ".download");

 		wxCommandEvent* evt = new wxCommandEvent(EVT_DWNLDR_FILE_NAME_CHANGE);
 		evt->SetString(boost::nowide::widen(m_filename));
@@ -203,32 +221,7 @@ void FileGet::priv::get_perform()
 			if(dest_path.empty()) {
 				std::string filename = extract_remote_filename(header);
 				if (!filename.empty()) {
-					// The name comes from the server: keep it inside the destination folder and never
-					// replace an existing file. Keep the current name if nothing usable remains.
-					filename = sanitize_file_basename(filename);
-					std::string unused;
-					try {
-						if (filename.empty() || !find_unused_filename(m_dest_folder, filename, m_tmp_path, unused))
-							unused.clear();
-					} catch (const boost::filesystem::filesystem_error&) {
-						unused.clear();
-					}
-					const boost::filesystem::path tmp_path = unused.empty() ? m_tmp_path : download_marker_path(m_dest_folder, unused);
-					if (tmp_path != m_tmp_path) {
-						// Move the marker to the adopted name so that other downloads see the name as taken.
-						// Only before anything is written, so that no downloaded data has to be carried over.
-						FILE* tmp_file = m_written == 0 ? fopen(wxString(tmp_path.wstring()).c_str(), "wb") : nullptr;
-						if (tmp_file != nullptr) {
-							fclose(file);
-							boost::system::error_code ec;
-							boost::filesystem::remove(m_tmp_path, ec);
-							file = tmp_file;
-							m_tmp_path = tmp_path;
-						} else
-							unused.clear();
-					}
-					if (!unused.empty())
-						m_filename = unused;
+					m_filename = filename;
 					dest_path = m_dest_folder / m_filename;
 					wxCommandEvent* evt = new wxCommandEvent(EVT_DWNLDR_FILE_NAME_CHANGE);
 					evt->SetString(boost::nowide::widen(m_filename));
@@ -334,18 +327,6 @@ void FileGet::priv::get_perform()
                    m_evt_handler->QueueEvent(evt);
                }
 				fclose(file);
-				// Another file may have taken the name while downloading.
-				if (!dest_path.empty() && boost::filesystem::exists(dest_path)) {
-					std::string unused;
-					if (!find_unused_filename(m_dest_folder, m_filename, m_tmp_path, unused))
-						throw std::runtime_error("No unused file name.");
-					m_filename = unused;
-					dest_path = m_dest_folder / m_filename;
-					wxCommandEvent* evt = new wxCommandEvent(EVT_DWNLDR_FILE_NAME_CHANGE);
-					evt->SetString(boost::nowide::widen(m_filename));
-					evt->SetInt(m_id);
-					m_evt_handler->QueueEvent(evt);
-				}
 				boost::filesystem::rename(m_tmp_path, dest_path);
 			}
 			catch (const std::exception& /*e*/)
@@ -15681,11 +15681,6 @@ void Plater::import_model_id(wxString download_info)
        //wxString sError = error.what();
    }

-    // The name comes from the link: reduce it to a plain file name inside the download folder.
-    filename = from_u8(sanitize_file_basename(into_u8(filename)));
-    if (filename.empty())
-        filename = "untitled.3mf";
-
    bool download_ok = false;
    int retry_count = 0;
    const int max_retries = 3;
@@ -15727,28 +15722,51 @@ void Plater::import_model_id(wxString download_info)

        msg = _L("Preparing 3MF file...");

+        //gets the number of files with the same name
+        std::vector<wxString>   vecFiles;
+        bool                    is_already_exist = false;
+
+
        target_path = fs::path(wxGetApp().app_config->get("download_path"));

-        //check file suffix
-        wxString extension = fs::path(filename.wx_str()).extension().c_str();
-        if (!extension.Contains(".3mf")) {
-            msg = _L("Download failed; unknown file format.");
-            return;
+        try
+        {
+            vecFiles.clear();
+            wxString extension = fs::path(filename.wx_str()).extension().c_str();
+
+
+            //check file suffix
+            if (!extension.Contains(".3mf")) {
+                msg = _L("Download failed; unknown file format.");
+                return;
+            }
+
+            auto name = filename.substr(0, filename.length() - extension.length() - 1);
+
+            for (const auto& iter : boost::filesystem::directory_iterator(target_path))
+            {
+                if (boost::filesystem::is_directory(iter.path()))
+                    continue;
+
+                wxString sFile = iter.path().filename().string().c_str();
+                if (strstr(sFile.c_str(), name.c_str()) != NULL) {
+                    vecFiles.push_back(sFile);
+                }
+
+                if (sFile == filename) is_already_exist = true;
+            }
+        }
+        catch (const std::exception&)
+        {
+            //wxString sError = error.what();
        }

-        //never replace an existing file
-        std::string unused_filename;
-        try {
-            if (!find_unused_filename(target_path, into_u8(filename), {}, unused_filename))
-                unused_filename.clear();
-        } catch (const std::exception&) {
-            unused_filename.clear();
+        //update filename
+        if (is_already_exist && vecFiles.size() >= 1) {
+            wxString extension = fs::path(filename.wx_str()).extension().c_str();
+            wxString name = filename.substr(0, filename.length() - extension.length());
+            filename = wxString::Format("%s(%d)%s", name, vecFiles.size() + 1, extension).ToStdString();
        }
-        if (unused_filename.empty()) {
-            msg = _L("Importing to Orca Slicer failed. Please download the file and manually import it.");
-            return;
-        }
-        filename = from_u8(unused_filename);


        msg = _L("Downloading project...");
@@ -15760,6 +15778,10 @@ void Plater::import_model_id(wxString download_info)
        boost::uuids::uuid uuid = boost::uuids::random_generator()();
        std::string unique = to_string(uuid).substr(0, 6);

+        if (filename.empty()) {
+            filename = "untitled.3mf";
+        }
+
        //target_path /= (boost::format("%1%_%2%.3mf") % filename % unique).str();
        target_path /= fs::path(filename.wc_str());

@@ -15808,26 +15830,13 @@ void Plater::import_model_id(wxString download_info)
                        cont = false;
                    }
                })
-                .on_complete([&cont, &download_ok, &msg, tmp_path, &target_path](std::string body, unsigned /* http_status */) {
+                .on_complete([&cont, &download_ok, tmp_path, target_path](std::string body, unsigned /* http_status */) {
                        fs::fstream file(tmp_path, std::ios::out | std::ios::binary | std::ios::trunc);
                        file.write(body.c_str(), body.size());
                        file.close();
+                        fs::rename(tmp_path, target_path);
                        cont = false;
-                        try {
-                            // Another file may have taken the name while downloading.
-                            std::string unused_filename;
-                            if (find_unused_filename(target_path.parent_path(), target_path.filename().string(), {}, unused_filename)) {
-                                target_path = target_path.parent_path() / unused_filename;
-                                fs::rename(tmp_path, target_path);
-                                download_ok = true;
-                                return;
-                            }
-                        } catch (const std::exception &e) {
-                            BOOST_LOG_TRIVIAL(error) << "import_model_id: failed to move the download into place: " << e.what();
-                        }
-                        boost::system::error_code ec;
-                        fs::remove(tmp_path, ec);
-                        msg = _L("Importing to Orca Slicer failed. Please download the file and manually import it.");
+                        download_ok = true;
                }).perform_sync();

                // for break while
@@ -27,6 +27,7 @@
 #include "GUI_App.hpp"
 #include "GUI_ObjectList.hpp"
 #include "MainFrame.hpp"
+#include "MsgDialog.hpp"
 #include <slic3r/GUI/Widgets/WebView.hpp>

 namespace Slic3r { namespace GUI {
@@ -293,9 +294,24 @@ void ProjectPanel::OnScriptMessage(wxWebViewEvent& evt)
            if (!accessory_path.empty()) {
                std::string decode_path = wxGetApp().url_decode(accessory_path.ToStdString());
                fs::path path(decode_path);
+                // Only open the project's own extracted auxiliary files, with the root built as in Reload().
+                fs::path aux_root(encode_path(wxGetApp().plater()->model().get_auxiliary_file_temp_path().c_str()));

-                if (fs::exists(path)) {
-                    wxLaunchDefaultApplication(path.wstring(), 0);
+                if (is_absolute_path_within_root(path, aux_root) && fs::is_regular_file(path)) {
+                    // Attachments come with the project, so ask before running one that is a program or script.
+                    bool open = true;
+                    if (is_executable_file_name(path.filename().string())) {
+                        MessageDialog dlg(this,
+                                          wxString::Format(_L("\"%s\" is a program or script. Opening it will run it on this computer.\n\n"
+                                                              "Only open attachments from projects you trust. Open it anyway?"),
+                                                           from_path(path.filename())),
+                                          _L("Open attachment"), wxICON_WARNING | wxYES_NO);
+                        open = dlg.ShowModal() == wxID_YES;
+                    }
+                    if (open)
+                        wxLaunchDefaultApplication(path.wstring(), 0);
+                } else {
+                    BOOST_LOG_TRIVIAL(warning) << "open_3mf_accessory: ignoring path outside the project auxiliary directory: " << decode_path;
                }
            }
        }
@@ -153,93 +153,64 @@ TEST_CASE("resolve_cli_input_path leaves inputs that must not be completed uncha
    }
 }

-TEST_CASE("sanitize_file_basename keeps only a plain file name from an untrusted name", "[Utils]") {
-    const std::string unicode = "\xe6\xa8\xa1\xe5\x9e\x8b \xc3\xa9t\xc3\xa9.3mf"; // UTF-8 CJK and accented Latin
-    const auto [input, expected] = GENERATE_COPY(table<std::string, std::string>({
-        {"normal.3mf", "normal.3mf"},
-        {"../../x.3mf", "x.3mf"},
-        {"..\\..\\x.3mf", "x.3mf"},
-        {"C:\\x.3mf", "x.3mf"},
-        {"C:x.3mf", "C_x.3mf"},
-        {"/etc/x", "x"},
-        {"a/b\\c.gcode", "c.gcode"},
-        {"x:stream", "x_stream"}, // no NTFS alternate data stream
-        {"x.", "x."},
-        {".3mf", ".3mf"},
-        {unicode, unicode},
-    }));
-    CAPTURE(input);
-    CHECK(sanitize_file_basename(input) == expected);
+TEST_CASE("is_absolute_path_within_root accepts only entries inside the root", "[utils]") {
+    namespace fs = boost::filesystem;
+    ScopedTemporaryDir outer;
+    const fs::path root = outer.path() / "Auxiliaries";
+    fs::create_directories(root / "Others");
+    const fs::path inside = root / "Others" / "note.txt";
+    const fs::path outside = outer.path() / "secret.txt";
+    std::ofstream(inside.string()) << "inside";
+    std::ofstream(outside.string()) << "outside";
+
+    SECTION("a file inside the root") {
+        REQUIRE(is_absolute_path_within_root(inside, root));
+    }
+    SECTION("a path inside the root whose file does not exist yet") {
+        REQUIRE(is_absolute_path_within_root(root / "Others" / "missing.txt", root));
+    }
+    SECTION("the root itself") {
+        REQUIRE_FALSE(is_absolute_path_within_root(root, root));
+    }
+    SECTION("a parent-directory escape spelled under the root") {
+        REQUIRE_FALSE(is_absolute_path_within_root(root / "Others" / ".." / ".." / "secret.txt", root));
+    }
+    SECTION("an absolute path elsewhere") {
+        REQUIRE_FALSE(is_absolute_path_within_root(outside, root));
+    }
+    SECTION("a sibling directory sharing the root's name as a prefix") {
+        const fs::path sibling = outer.path() / "Auxiliaries2" / "note.txt";
+        REQUIRE_FALSE(is_absolute_path_within_root(sibling, root));
+    }
+    SECTION("a relative path") {
+        REQUIRE_FALSE(is_absolute_path_within_root(fs::path("Others") / "note.txt", root));
+    }
+    SECTION("an empty path") {
+        REQUIRE_FALSE(is_absolute_path_within_root(fs::path(), root));
+    }
+#ifndef _WIN32
+    // Creating symlinks on Windows needs elevated rights or developer mode.
+    SECTION("a symlink inside the root that points outside") {
+        const fs::path link = root / "Others" / "link.txt";
+        fs::create_symlink(outside, link);
+        REQUIRE_FALSE(is_absolute_path_within_root(link, root));
+    }
+#endif
 }

-TEST_CASE("sanitize_file_basename rejects names that do not name a file", "[Utils]") {
-    const std::string input = GENERATE(as<std::string>{}, "", ".", "..", "../..", "dir/", "..\\", " ", ". .", "...");
-    CAPTURE(input);
-    CHECK(sanitize_file_basename(input).empty());
+TEST_CASE("is_executable_file_name flags attachments that would run as programs", "[utils]") {
+    const std::string executable = GENERATE(as<std::string>{},
+        "setup.exe", "SETUP.EXE", "Manual.pdf.exe", "run.bat", "start.cmd", "shortcut.lnk", "site.url", "script.ps1",
+        "macro.vbs", "tool.jar", "script.py", "Install.command", "Tool.app", "installer.pkg", "install.sh",
+        "launcher.desktop", "Printer.AppImage", "setup.exe.", "setup.exe ", "setup.exe. .", ".exe");
+    INFO(executable);
+    CHECK(is_executable_file_name(executable));
 }

-namespace {
-void touch(const boost::filesystem::path &path) { std::ofstream(path.string()) << "existing"; }
-std::string file_contents(const boost::filesystem::path &path)
-{
-    std::ifstream file(path.string());
-    return std::string(std::istreambuf_iterator<char>(file), std::istreambuf_iterator<char>());
-}
-} // namespace
-
-TEST_CASE("find_unused_filename keeps a name nothing uses", "[Utils]") {
-    ScopedTemporaryDir dir;
-    std::string name;
-    REQUIRE(find_unused_filename(dir.path(), "model.3mf", {}, name));
-    CHECK(name == "model.3mf");
-}
-
-TEST_CASE("find_unused_filename versions a name an existing file uses", "[Utils]") {
-    ScopedTemporaryDir dir;
-    touch(dir.path() / "model.3mf");
-    std::string name;
-    REQUIRE(find_unused_filename(dir.path(), "model.3mf", {}, name));
-    CHECK(name == "model(1).3mf");
-}
-
-TEST_CASE("find_unused_filename versions a name that maps onto an existing file once sanitized", "[Utils]") {
-    ScopedTemporaryDir dir;
-    touch(dir.path() / "my_model.3mf");
-    const std::string input = GENERATE(as<std::string>{}, "my?model.3mf", "my:model.3mf", "my*model.3mf");
-    CAPTURE(input);
-    std::string name;
-    REQUIRE(find_unused_filename(dir.path(), input, {}, name));
-    CHECK(name == "my_model(1).3mf");
-    CHECK(file_contents(dir.path() / "my_model.3mf") == "existing");
-}
-
-TEST_CASE("find_unused_filename treats the marker of another download as used", "[Utils]") {
-    ScopedTemporaryDir dir;
-    touch(download_marker_path(dir.path(), "model.3mf"));
-    std::string name;
-    REQUIRE(find_unused_filename(dir.path(), "model.3mf", {}, name));
-    CHECK(name == "model(1).3mf");
-}
-
-TEST_CASE("find_unused_filename ignores the marker of the download asking", "[Utils]") {
-    ScopedTemporaryDir dir;
-    const boost::filesystem::path own_marker = download_marker_path(dir.path(), "model.3mf");
-    touch(own_marker);
-    std::string name;
-    REQUIRE(find_unused_filename(dir.path(), "model.3mf", own_marker, name));
-    CHECK(name == "model.3mf");
-}
-
-TEST_CASE("find_unused_filename gives up after 999 versions", "[Utils]") {
-    ScopedTemporaryDir dir;
-    touch(dir.path() / "model.3mf");
-    for (int version = 1; version < 999; ++version)
-        touch(dir.path() / ("model(" + std::to_string(version) + ").3mf"));
-    std::string name;
-    REQUIRE(find_unused_filename(dir.path(), "model.3mf", {}, name));
-    CHECK(name == "model(999).3mf");
-
-    touch(dir.path() / name);
-    REQUIRE_FALSE(find_unused_filename(dir.path(), "model.3mf", {}, name));
-    CHECK(name == "model(999).3mf");
+TEST_CASE("is_executable_file_name leaves documents and models alone", "[utils]") {
+    const std::string document = GENERATE(as<std::string>{},
+        "Manual.pdf", "BOM.xlsx", "notes.txt", "photo.JPG", "assembly.step", "part.stl", "project.3mf", "readme",
+        "exe", "setup.exe.pdf", "", "...", "dir.exe/readme");
+    INFO(document);
+    CHECK_FALSE(is_executable_file_name(document));
 }