0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use looks_like_pbl() to disallow .pbl file inclusion (bug #23504)

Browse source 
This function is implemented using case-insensitive pattern matching,
unlike filesystem::ends_with(). I missed this when writing my original
fix, so the vulnerability still applied to .pbl files on a
case-insensitive filesystem (e.g. NTFS and FAT* on Windows) by using
different case to bypass the check.
This commit is contained in:
Ignacio R. Morelle 2015-06-16 23:08:52 -03:00
parent 634d29020f
commit b2738ffb2f
4 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
changelog
View file

@ -1,6 +1,7 @@
Version 1.13.0+dev:
* Security fixes:
* Disallowed inclusion of .pbl files from WML (bug #23504).
* Disallowed inclusion of .pbl files from WML (bug #23504), independent of
file name case.
* AI:
* Fast Micro AI: exclude hidden enemies from attack evaluation by default;
add optional key attack_hidden_enemies to override this

3
players_changelog
View file

@ -4,7 +4,8 @@ changelog: https://github.com/wesnoth/wesnoth/blob/master/changelog
Version 1.13.0+dev:
* Security fixes:
* Disallowed inclusion of .pbl files from WML (bug #23504).
* Disallowed inclusion of .pbl files from WML (bug #23504), independent of
file name case.
* Campaigns:
* Dead Water:

2
src/filesystem.cpp
View file

@ -1008,7 +1008,7 @@ std::string get_wml_location(const std::string &filename, const std::string &cur
return result;
}
if (ends_with(filename, ".pbl")) {
if (looks_like_pbl(filename)) {
ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
return result;
}

2
src/filesystem_boost.cpp
View file

@ -1000,7 +1000,7 @@ static bool is_legal_file(const std::string &filename)
return false;
}
if (ends_with(filename, ".pbl")) {
if (looks_like_pbl(filename)) {
ERR_FS << "Illegal path '" << filename << "' (.pbl files are not allowed)." << std::endl;
return false;
}