From f7a88b905560df4366fb69f09b70f05984e05ad3 Mon Sep 17 00:00:00 2001 From: MCJack123 Date: Fri, 16 Aug 2024 07:16:12 -0400 Subject: [PATCH] v2.8.3: Improved path sanitization, fixed #365 --- resources/CraftOS-PC.exe.manifest | 2 +- resources/Info.plist | 4 ++-- src/apis/fs.cpp | 4 ++-- src/apis/http.cpp | 5 ++--- src/platform/CraftOS-PC 2.rc | 8 ++++---- src/util.cpp | 12 ++++++------ src/util.hpp | 10 +++++----- 7 files changed, 22 insertions(+), 23 deletions(-) diff --git a/resources/CraftOS-PC.exe.manifest b/resources/CraftOS-PC.exe.manifest index ce0fb616..f4d63c0e 100644 --- a/resources/CraftOS-PC.exe.manifest +++ b/resources/CraftOS-PC.exe.manifest @@ -3,7 +3,7 @@ Advanced ComputerCraft Emulator diff --git a/resources/Info.plist b/resources/Info.plist index a8ecb863..14e1dabd 100644 --- a/resources/Info.plist +++ b/resources/Info.plist @@ -21,13 +21,13 @@ CFBundlePackageType APPL CFBundleShortVersionString - 2.8.2 + 2.8.3 CFBundleSignature ???? LSApplicationCategoryType Unknown CFBundleVersion - 2.8.2 + 2.8.3 NSHumanReadableCopyright Copyright (C) 2019-2024 JackMacWindows. NSHighResolutionCapable diff --git a/src/apis/fs.cpp b/src/apis/fs.cpp index e780b8ea..cc1488f4 100644 --- a/src/apis/fs.cpp +++ b/src/apis/fs.cpp @@ -67,8 +67,9 @@ inline bool isVFSPath(path_t path) { return false; } -static std::vector fixpath_multiple(Computer *comp, const std::string& path) { +static std::vector fixpath_multiple(Computer *comp, std::string path) { std::vector retval; + path.erase(std::remove_if(path.begin(), path.end(), [](char c)->bool {return c == '"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|' || c < 32; }), path.end()); std::vector elems = split(path, "/\\"); std::list pathc; for (std::string s : elems) { @@ -77,7 +78,6 @@ static std::vector fixpath_multiple(Computer *comp, const std::string& p else if (pathc.empty()) pathc.push_back(".."); else pathc.pop_back(); } else if (!s.empty() && !std::all_of(s.begin(), s.end(), [](const char c)->bool{return c == '.';})) { - s.erase(std::remove_if(s.begin(), s.end(), [](char c)->bool{return c=='"'||c==':'||c=='<'||c=='>'||c=='?'||c=='|';}), s.end()); pathc.push_back(s); } } diff --git a/src/apis/http.cpp b/src/apis/http.cpp index d0087d6e..2794a31f 100644 --- a/src/apis/http.cpp +++ b/src/apis/http.cpp @@ -835,11 +835,10 @@ static int websocket_send(lua_State *L) { std::string str = checkstring(L, 1); if (config.http_max_websocket_message > 0 && str.size() > (unsigned)config.http_max_websocket_message) luaL_error(L, "Message is too large"); ws_handle * ws = *(ws_handle**)lua_touserdata(L, lua_upvalueindex(1)); - if (ws == NULL) luaL_error(L, "attempt to use a closed file"); + if (ws == NULL) return luaL_error(L, "attempt to use a closed file"); std::lock_guard lock(ws->lock); if (ws->ws == NULL) return luaL_error(L, "attempt to use a closed file"); - if (ws->ws->sendFrame(str.c_str(), str.size(), (int)WebSocket::FRAME_FLAG_FIN | (int)(lua_toboolean(L, 2) ? WebSocket::FRAME_BINARY : WebSocket::FRAME_TEXT)) < 1) - websocket_close(L); + ws->ws->sendFrame(str.c_str(), str.size(), (int)WebSocket::FRAME_FLAG_FIN | (int)(lua_toboolean(L, 2) ? WebSocket::FRAME_BINARY : WebSocket::FRAME_TEXT)); return 0; } diff --git a/src/platform/CraftOS-PC 2.rc b/src/platform/CraftOS-PC 2.rc index 25f9bc2d..5146fba7 100644 --- a/src/platform/CraftOS-PC 2.rc +++ b/src/platform/CraftOS-PC 2.rc @@ -60,8 +60,8 @@ MANIFEST RT_MANIFEST "..\\..\\resources\\CraftOS-PC.e // VS_VERSION_INFO VERSIONINFO - FILEVERSION 2,8,2,0 - PRODUCTVERSION 2,8,2,0 + FILEVERSION 2,8,3,0 + PRODUCTVERSION 2,8,3,0 FILEFLAGSMASK 0x3fL #ifdef _DEBUG FILEFLAGS 0x1L @@ -77,12 +77,12 @@ BEGIN BLOCK "040904b0" BEGIN VALUE "FileDescription", "CraftOS-PC" - VALUE "FileVersion", "2.8.2.0" + VALUE "FileVersion", "2.8.3.0" VALUE "InternalName", "CraftOS-PC.exe" VALUE "LegalCopyright", "Copyright (C) 2019-2024 JackMacWindows." VALUE "OriginalFilename", "CraftOS-PC.exe" VALUE "ProductName", "CraftOS-PC" - VALUE "ProductVersion", "2.8.2.0" + VALUE "ProductVersion", "2.8.3.0" END END BLOCK "VarFileInfo" diff --git a/src/util.cpp b/src/util.cpp index 6f013219..5b58cd11 100644 --- a/src/util.cpp +++ b/src/util.cpp @@ -165,7 +165,8 @@ inline bool isVFSPath(path_t path) { return false; } -path_t fixpath(Computer *comp, const std::string& path, bool exists, bool addExt, std::string * mountPath, bool * isRoot) { +path_t fixpath(Computer *comp, std::string path, bool exists, bool addExt, std::string * mountPath, bool * isRoot) { + path.erase(std::remove_if(path.begin(), path.end(), [](char c)->bool {return c == '"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|' || c < 32; }), path.end()); std::vector elems = split(path, "/\\"); std::list pathc; for (std::string s : elems) { @@ -175,7 +176,6 @@ path_t fixpath(Computer *comp, const std::string& path, bool exists, bool addExt else pathc.pop_back(); } else if (!s.empty() && s.find_first_not_of(' ') != std::string::npos && !std::all_of(s.begin(), s.end(), [](const char c)->bool{return c == '.';})) { s = s.substr(s.find_first_not_of(' '), s.find_last_not_of(' ') - s.find_first_not_of(' ') + 1); - s.erase(std::remove_if(s.begin(), s.end(), [](char c)->bool{return c=='"'||c==':'||c=='<'||c=='>'||c=='?'||c=='|';}), s.end()); pathc.push_back(s); } } @@ -274,14 +274,14 @@ path_t fixpath(Computer *comp, const std::string& path, bool exists, bool addExt return ss; } -bool fixpath_ro(Computer *comp, const std::string& path) { +bool fixpath_ro(Computer *comp, std::string path) { + path.erase(std::remove_if(path.begin(), path.end(), [](char c)->bool {return c == '"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|' || c < 32; }), path.end()); std::vector elems = split(path, "/\\"); std::list pathc; for (std::string s : elems) { if (s == "..") { if (pathc.empty()) return false; else pathc.pop_back(); } else if (!s.empty() && !std::all_of(s.begin(), s.end(), [](const char c)->bool{return c == '.';})) { s = s.substr(s.find_first_not_of(' '), s.find_last_not_of(' ') - s.find_first_not_of(' ') + 1); - s.erase(std::remove_if(s.begin(), s.end(), [](char c)->bool{return c=='"'||c==':'||c=='<'||c=='>'||c=='?'||c=='|';}), s.end()); pathc.push_back(s); } } @@ -299,14 +299,14 @@ bool fixpath_ro(Computer *comp, const std::string& path) { return max_path.second; } -std::set getMounts(Computer * computer, const std::string& comp_path) { +std::set getMounts(Computer * computer, std::string comp_path) { + comp_path.erase(std::remove_if(comp_path.begin(), comp_path.end(), [](char c)->bool {return c == '"' || c == '*' || c == ':' || c == '<' || c == '>' || c == '?' || c == '|' || c < 32; }), comp_path.end()); std::vector elems = split(comp_path, "/\\"); std::list pathc; std::set retval; for (std::string s : elems) { if (s == "..") { if (pathc.empty()) return retval; else pathc.pop_back(); } else if (!s.empty() && !std::all_of(s.begin(), s.end(), [](const char c)->bool{return c == '.';})) { - s.erase(std::remove_if(s.begin(), s.end(), [](char c)->bool{return c=='"'||c==':'||c=='<'||c=='>'||c=='?'||c=='|';}), s.end()); pathc.push_back(s); } } diff --git a/src/util.hpp b/src/util.hpp index 1b906fdd..b8ab2d1a 100644 --- a/src/util.hpp +++ b/src/util.hpp @@ -26,8 +26,8 @@ extern "C" { #include #include -#define CRAFTOSPC_VERSION "v2.8.2" -#define CRAFTOSPC_CC_VERSION "1.110.2" +#define CRAFTOSPC_VERSION "v2.8.3" +#define CRAFTOSPC_CC_VERSION "1.112.0" #define CRAFTOSPC_INDEV false using path_t = std::filesystem::path; @@ -203,10 +203,10 @@ extern std::vector split(const std::wstring& strToSplit, const wch extern std::vector split(const path_t& strToSplit, const path_t::value_type * delimeter); extern void load_library(Computer *comp, lua_State *L, const library_t& lib); extern void HTTPDownload(const std::string& url, const std::function& callback); -extern path_t fixpath(Computer *comp, const std::string& path, bool exists, bool addExt = true, std::string * mountPath = NULL, bool * isRoot = NULL); -extern bool fixpath_ro(Computer *comp, const std::string& path); +extern path_t fixpath(Computer *comp, std::string path, bool exists, bool addExt = true, std::string * mountPath = NULL, bool * isRoot = NULL); +extern bool fixpath_ro(Computer *comp, std::string path); extern path_t fixpath_mkdir(Computer * comp, const std::string& path, bool md = true, std::string * mountPath = NULL); -extern std::set getMounts(Computer * computer, const std::string& comp_path); +extern std::set getMounts(Computer * computer, std::string comp_path); extern void peripheral_update(Computer *comp); extern struct computer_configuration getComputerConfig(int id); extern void setComputerConfig(int id, const computer_configuration& cfg);