0xf8/pollymc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: don't extract files outside of target path

Browse Source 
This should fix a security issue regarding path traversal in zip files.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
This commit is contained in:
Sefa Eyeoglu 2023-02-10 09:17:48 +01:00
parent f36c3a3f6c
commit 6be7eed878
No known key found for this signature in database
GPG Key ID: E13DFD4B47127951
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
launcher/MMCZip.cpp
View File

@ -275,7 +275,8 @@ bool MMCZip::findFilesInZip(QuaZip * zip, const QString & what, QStringList & re
// ours // ours
std::optional<QStringList> MMCZip::extractSubDir(QuaZip *zip, const QString & subdir, const QString &target) std::optional<QStringList> MMCZip::extractSubDir(QuaZip *zip, const QString & subdir, const QString &target)
{ {
QDir directory(target); auto absDirectoryUrl = QUrl::fromLocalFile(target);
QStringList extracted; QStringList extracted;
qDebug() << "Extracting subdir" << subdir << "from" << zip->getZipName() << "to" << target; qDebug() << "Extracting subdir" << subdir << "from" << zip->getZipName() << "to" << target;
@ -317,11 +318,16 @@ std::optional<QStringList> MMCZip::extractSubDir(QuaZip *zip, const QString & su
QString absFilePath; QString absFilePath;
if(name.isEmpty()) if(name.isEmpty())
{ {
absFilePath = directory.absoluteFilePath(name) + "/"; absFilePath = FS::PathCombine(target, "/"); // FIXME this seems weird
} }
else else
{ {
absFilePath = directory.absoluteFilePath(path + name); absFilePath = FS::PathCombine(target, path + name);
}
if (!absDirectoryUrl.isParentOf(QUrl::fromLocalFile(absFilePath))) {
qWarning() << "Extracting" << name << "was cancelled, because it was effectively outside of the target path" << target;
return std::nullopt;
} }
if (!JlCompress::extractFile(zip, "", absFilePath)) if (!JlCompress::extractFile(zip, "", absFilePath))