Still dont' allow slashes in names. Anything else is fine.

1 files changed, 3 insertions, 1 deletions

diff --git a/lib/utils/read-json.js b/lib/utils/read-json.js
index 282fbedd9..728934956 100644
--- a/lib/utils/read-json.js
+++ b/lib/utils/read-json.js
@@ -30,13 +30,15 @@ function readJson (jsonFile, cb) {
       }
     });
 
+    // slashes would be a security risk.
+    json.name = json.name.replace(/\//g, '-');
     // allow semvers, but also stuff like
     // 0.1.2beta-L24561-2010-02-25-13-41-32-903 for test/link packages.
     if (!(semver.valid(json.version))) {
       return cb(new Error("Invalid version: "+json.version));
     }
 
-    var key = json.name+"@"+json.version;
+    var key = json.name+"-"+json.version;
     json._id = key;
     testEngine(json, cb);
   });