Sneederix/sneedmc
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #1546 from LennyMcLennington/fix/dont-unzip-invalid-filenames

Browse Source 
fix(MMCZip): ignore invalid file paths in extractSubDir
This commit is contained in:
Lenny McLennington 2023-02-10 01:17:49 +00:00 committed by GitHub
commit 4398cb5dc5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
launcher/MMCZip.cpp
View File

@ -292,10 +292,15 @@ std::optional<QStringList> MMCZip::extractSubDir(QuaZip *zip, const QString & su
do
{
QString name = zip->getCurrentFileName();
if(!name.startsWith(subdir))
if(!QDir::cleanPath(name).startsWith(subdir))
{
continue;
}
if (QDir::isAbsolutePath(name) || QDir::cleanPath(name).startsWith(".."))
{
qDebug() << "extractSubDir: Skipping file that tries to place itself in an absolute location or in a parent directory.";
continue;
}
name.remove(0, subdir.size());
auto original_name = name;