0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

campaignd: Restrict possible add-on name chars to a whitelist

Browse source 
The new whitelist includes all alphanumerical characters,
hyphen-minuses -, and underlines _ ([A-Za-z0-9_-]).
This commit is contained in:
Ignacio R. Morelle 2013-06-14 21:10:35 -04:00
parent 93f9e0c9cc
commit 04f34c0b69
2 changed files with 27 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
src/addon/validation.cpp
View file

@ -27,12 +27,30 @@ namespace {
"map_pack", "era", "faction", "mod_mp", /*"gui", */ "media", "other",
""
};
struct addon_name_char_illegal
{
/**
* Returns whether the given add-on name char is not whitelisted.
*/
inline bool operator()(char c)
{
switch(c)
{
case '-': // hyphen-minus
case '_': // low line
return false;
default:
return !isalnum(c);
}
}
};
}
bool addon_name_legal(const std::string& name)
{
if(name.empty() || name == "." ||
name.find_first_of("/:\\~") != std::string::npos ||
std::find_if(name.begin(), name.end(), addon_name_char_illegal()) != name.end() ||
name.find("..") != std::string::npos) {
return false;
} else {

8
src/tests/test_addons.cpp
View file

@ -22,6 +22,8 @@ BOOST_AUTO_TEST_SUITE( addons )
BOOST_AUTO_TEST_CASE( validation )
{
BOOST_CHECK( addon_name_legal("-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz") );
BOOST_CHECK( !addon_name_legal("") );
BOOST_CHECK( !addon_name_legal(".") );
BOOST_CHECK( !addon_name_legal("invalid/slash") );
@ -29,6 +31,12 @@ BOOST_AUTO_TEST_CASE( validation )
BOOST_CHECK( !addon_name_legal("invalid:colon") );
BOOST_CHECK( !addon_name_legal("invalid~tilde") );
BOOST_CHECK( !addon_name_legal("invalid/../parent") );
BOOST_CHECK( !addon_name_legal("invalid\nnewline") );
BOOST_CHECK( !addon_name_legal("invalid\x0A""explicitLF") );
BOOST_CHECK( !addon_name_legal("invalid\x0D\x0A""explicitCRLF") );
BOOST_CHECK( !addon_name_legal("invalid\x0D""explicitCR") );
BOOST_CHECK( !addon_name_legal("invalid`grave accent`") );
BOOST_CHECK( !addon_name_legal("invalid$dollarsign$") );
}
BOOST_AUTO_TEST_SUITE_END()