Created avatar_lib is_valid() method and use it verify avatars meet the

reuirements (e.g. no chars that'll cause problems, no blink attribute)
before importing or exporting.
Added "verify" command to verify .bin files meet the avatar requirements
(e.g. "jsexec avatars verify -file=/path/to/some.bin")

exec/avatars.js

@@ -118,11 +118,25 @@ function valid_shared_file(filename)
     }
     if(sauce.datatype != SAUCE.defs.datatype.bin
 		|| sauce.cols != lib.defs.width
+		|| sauce.filesize < lib.size
 		|| (sauce.filesize%lib.size) != 0) {
         alert(format("%s has invalid SAUCE! (datatype=%u cols=%u size=%u)"
 			,filename, sauce.datatype, sauce.cols, sauce.filesize));
         return false;
     }
+	var file = new File(filename);
+	if(!file.open("rb"))
+		return false;
+	var data = file.read(sauce.filesize);
+	file.close();
+	var list = data.match(new RegExp('(.{1,' + lib.size + '})', 'g'));
+	printf("%u avatars\r\n", list.length);
+//	print(JSON.stringify(list, null, 4));
+	for(var i in list)
+		if(!lib.is_valid(list[i])) {
+			alert("Avatar " + i + " (" + list[i].length + " bytes) is invalid");
+			return false;
+		}
     return true;
 }
 
@@ -206,7 +220,8 @@ function import_from_msgbase(msgbase, import_ptr, limit, all)
 			success = import_shared_file(hdr, body);
 		}
 		printf("%s\r\n", success ? "success" : "FAILED");
-        count++;
+		if(success)
+			count++;
 		if(limit && count >= limit)
 			break;
     }
@@ -223,8 +238,11 @@ function import_from_msgbase(msgbase, import_ptr, limit, all)
 function decompress_list(list)
 {
 	var new_list = [];
-	for(var i in list)
-		new_list[base64_encode(LZString.decompressFromBase64(i.replace(/\s+/g, '')))] = list[i];
+	for(var i in list) {
+		var data = LZString.decompressFromBase64(i.replace(/\s+/g, ''));
+		if(lib.is_valid(data))
+			new_list[base64_encode(data)] = list[i];
+	}
 	return new_list;
 }
 
@@ -389,6 +407,12 @@ function main()
 					usernum = user.number;
 				var obj = lib.show(usernum);
 				break;
+			case "verify":
+				if(filename) {
+				    var success = valid_shared_file(filename);
+					print(success ? "Successful" : "FAILED");
+				}
+				break;
 		}
 	}
 }

exec/load/avatar_lib.js

@@ -24,6 +24,31 @@ function netuser_fname(netaddr)
 	return format("%sqnet/%s.avatars.ini", system.data_dir, file_getname(netaddr));
 }
 
+function is_valid(buf)
+{
+	if(!buf || !buf.length || buf.length != this.size)
+		return false;
+	var invalid = buf.split('').filter(function (e,i) { 
+		if((i&1) == 0) { // char
+			switch(e) {
+				case '\r':
+				case '\n':
+				case '\a':
+				case '\b':
+				case '\t':
+				case '\f':
+				case '\x1b':	// ESC
+				case '\xff':	// Telnet IAC
+					return true;
+			}
+			return false;
+		}
+		// attr
+		return (ascii(e)&BLINK);
+		});
+	return invalid.length == 0;
+}
+
 function write_localuser(usernum, obj)
 {
 	var file = new File(this.localuser_fname(usernum));
@@ -92,6 +117,8 @@ function import_file(usernum, filename, offset)
 	var graphic = new Graphic(this.defs.width, this.defs.height);
 	if(!graphic.load(filename, offset))
 		return false;
+	if(!is_valid(graphic.BIN))
+		return false;
 	return update_localuser(usernum, base64_encode(graphic.BIN));
 }