0xf8/pollymc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: don't extract files outside of target path

Browse Source 
This should fix a security issue regarding path traversal in zip files.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
This commit is contained in:
Sefa Eyeoglu 2023-02-10 09:17:48 +01:00
parent f36c3a3f6c
commit 6be7eed878
No known key found for this signature in database
GPG Key ID: E13DFD4B47127951
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
launcher/MMCZip.cpp
View File

@ -275,7 +275,8 @@ bool MMCZip::findFilesInZip(QuaZip * zip, const QString & what, QStringList & re
// ours
std::optional<QStringList> MMCZip::extractSubDir(QuaZip *zip, const QString & subdir, const QString &target)
{
QDir directory(target);
auto absDirectoryUrl = QUrl::fromLocalFile(target);
QStringList extracted;
qDebug() << "Extracting subdir" << subdir << "from" << zip->getZipName() << "to" << target;
@ -317,11 +318,16 @@ std::optional<QStringList> MMCZip::extractSubDir(QuaZip *zip, const QString & su
QString absFilePath;
if(name.isEmpty())
{
absFilePath = directory.absoluteFilePath(name) + "/";
absFilePath = FS::PathCombine(target, "/"); // FIXME this seems weird
}
else
{
absFilePath = directory.absoluteFilePath(path + name);
absFilePath = FS::PathCombine(target, path + name);
}
if (!absDirectoryUrl.isParentOf(QUrl::fromLocalFile(absFilePath))) {
qWarning() << "Extracting" << name << "was cancelled, because it was effectively outside of the target path" << target;
return std::nullopt;
}
if (!JlCompress::extractFile(zip, "", absFilePath))