Sneederix/sneedmc
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #1537 from LennyMcLennington/security-fix

Browse Source 
fix(ModrinthInstanceCreationTask): ignore files with invalid paths
This commit is contained in:
Lenny McLennington 2023-02-04 12:20:56 +00:00 committed by GitHub
commit 01b52ea6be
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
launcher/modplatform/modrinth/ModrinthInstanceCreationTask.cpp
View File

@ -305,6 +305,11 @@ bool ModrinthCreationTask::parseManifest(const QString& index_path, std::vector<
Modrinth::File file;
file.path = Json::requireString(modInfo, "path");
if (QDir::isAbsolutePath(file.path) || QDir::cleanPath(file.path).startsWith("..")) {
qDebug() << "Skipped file that tries to place itself in an absolute location or in a parent directory.";
continue;
}
auto env = Json::ensureObject(modInfo, "env");
// 'env' field is optional
if (!env.isEmpty()) {