0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add extra filename blacklist checks

Browse source 
Check for invalid UTF-8, overly long filenames, surrogate pairs and all control characters.
This commit is contained in:
Alexander van Gessel 2017-10-06 12:07:11 +02:00
parent b2ca410252
commit c1bc0eaa7d
1 changed files with 30 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
src/addon/validation.cpp
View file

@ -15,6 +15,7 @@
#include "addon/validation.hpp"
#include "config.hpp"
#include "serialization/unicode_cast.hpp"
#include <algorithm>
@ -44,6 +45,27 @@ namespace {
}
}
};
struct addon_filename_ucs4char_illegal
{
inline bool operator()(ucs4::char_t c) const
{
switch(c){
case ' ':
case '/':
case ':':
case '\\':
case '~':
case 0x7F: // DEL
return true;
default:
return (
c < 0x20 || // control characters
(c >= 0xD800 && c < 0xE000) // surrogate pairs
);
}
}
};
}
bool addon_name_legal(const std::string& name)
@ -59,11 +81,16 @@ bool addon_name_legal(const std::string& name)
bool addon_filename_legal(const std::string& name)
{
if(name.empty() || name.back() == '.' ||
name.find_first_of("/:\\~ \r\n\v\t") != std::string::npos ||
name.find("..") != std::string::npos) {
name.find("..") != std::string::npos ||
name.size() > 255) {
return false;
} else {
return true;
const ucs4::string name_ucs4 = unicode_cast<ucs4::string>(name);
const std::string name_utf8 = unicode_cast<utf8::string>(name_ucs4);
if(name != name_utf8){ // name is invalid UTF-8
return false;
}
return std::find_if(name_ucs4.begin(), name_ucs4.end(), addon_filename_ucs4char_illegal()) == name_ucs4.end();
}
}