Merge pull request #4472 from JosJuice/revert-absolute-path

IOS HLE: Replace broken path traversal prevention

Source/Core/Common/FileUtil.cpp

@@ -5,7 +5,6 @@
 #include <algorithm>
 #include <cstddef>
 #include <cstdio>
-#include <cstdlib>
 #include <cstring>
 #include <fcntl.h>
 #include <limits.h>
@@ -31,6 +30,7 @@
 #include <dirent.h>
 #include <errno.h>
 #include <libgen.h>
+#include <stdlib.h>
 #include <unistd.h>
 #endif
 
@@ -712,19 +712,6 @@ std::string GetBundleDirectory()
 }
 #endif
 
-std::string GetAbsolutePath(const std::string& path)
-{
-#ifdef _WIN32
-  wchar_t absolute_path[_MAX_PATH];
-  wchar_t* result = _wfullpath(absolute_path, UTF8ToTStr(path).c_str(), _MAX_PATH);
-  return result ? TStrToUTF8(result) : "";
-#else
-  char absolute_path[MAX_PATH + 1];
-  char* result = realpath(path.c_str(), absolute_path);
-  return result ? result : "";
-#endif
-}
-
 std::string& GetExeDirectory()
 {
   static std::string DolphinPath;

Source/Core/Common/FileUtil.h

@@ -133,10 +133,6 @@ std::string CreateTempDir();
 // Get a filename that can hopefully be atomically renamed to the given path.
 std::string GetTempFilenameForAtomicWrite(const std::string& path);
 
-// Converts the given path into an absolute path.
-// An empty string is returned if an error occurs.
-std::string GetAbsolutePath(const std::string& path);
-
 // Gets a set user directory path
 // Don't call prior to setting the base user directory
 const std::string& GetUserPath(unsigned int dir_index);

Source/Core/Common/NandPaths.cpp

@@ -2,10 +2,12 @@
 // Licensed under GPLv2+
 // Refer to the license.txt file included.
 
+#include <algorithm>
 #include <cstdio>
 #include <fstream>
 #include <stdlib.h>
 #include <string>
+#include <unordered_set>
 #include <utility>
 
 #include "Common/CommonFuncs.h"
@@ -117,36 +119,61 @@ bool CheckTitleTIK(u64 _titleID, FromWhichRoot from)
   return false;
 }
 
-static void CreateReplacementFile(std::string& filename)
+std::string EscapeFileName(const std::string& filename)
 {
-  std::ofstream replace;
+  // Prevent paths from containing special names like ., .., ..., ...., and so on
-  OpenFStream(replace, filename, std::ios_base::out);
+  if (std::all_of(filename.begin(), filename.end(), [](char c) { return c == '.'; }))
-  replace << "\" __22__\n";
+    return ReplaceAll(filename, ".", "__2e__");
-  replace << "* __2a__\n";
+
-  // replace << "/ __2f__\n";
+  // Escape all double underscores since we will use double underscores for our escape sequences
-  replace << ": __3a__\n";
+  std::string filename_with_escaped_double_underscores = ReplaceAll(filename, "__", "__5f____5f__");
-  replace << "< __3c__\n";
+
-  replace << "> __3e__\n";
+  // Escape all other characters that need to be escaped
-  replace << "? __3f__\n";
+  static const std::unordered_set<char> chars_to_replace = {'\"', '*', '/',  ':', '<',
-  // replace <<"\\ __5c__\n";
+                                                            '>',  '?', '\\', '|', '\x7f'};
-  replace << "| __7c__\n";
+  std::string result;
+  result.reserve(filename_with_escaped_double_underscores.size());
+  for (char c : filename_with_escaped_double_underscores)
+  {
+    if ((c >= 0 && c <= 0x1F) || chars_to_replace.find(c) != chars_to_replace.end())
+      result.append(StringFromFormat("__%02x__", c));
+    else
+      result.push_back(c);
+  }
+
+  return result;
 }
 
-void ReadReplacements(replace_v& replacements)
+std::string EscapePath(const std::string& path)
 {
-  replacements.clear();
+  std::vector<std::string> split_strings;
-  const std::string replace_fname = "/sys/replace";
+  SplitString(path, '/', split_strings);
-  std::string filename = File::GetUserPath(D_SESSION_WIIROOT_IDX) + replace_fname;
 
-  if (!File::Exists(filename))
+  std::vector<std::string> escaped_split_strings;
-    CreateReplacementFile(filename);
+  escaped_split_strings.reserve(split_strings.size());
+  for (const std::string& split_string : split_strings)
+    escaped_split_strings.push_back(EscapeFileName(split_string));
 
-  std::ifstream f;
+  return JoinStrings(escaped_split_strings, "/");
-  OpenFStream(f, filename, std::ios_base::in);
+}
-  char letter;
-  std::string replacement;
 
-  while (f >> letter >> replacement && replacement.size())
+std::string UnescapeFileName(const std::string& filename)
-    replacements.emplace_back(letter, replacement);
+{
+  std::string result = filename;
+  size_t pos = 0;
+
+  // Replace escape sequences of the format "__3f__" with the ASCII
+  // character defined by the escape sequence's two hex digits.
+  while ((pos = result.find("__", pos)) != std::string::npos)
+  {
+    u32 character;
+    if (pos + 6 <= result.size() && result[pos + 4] == '_' && result[pos + 5] == '_')
+      if (AsciiToHex(result.substr(pos + 2, 2), character))
+        result.replace(pos, 6, {static_cast<char>(character)});
+
+    ++pos;
+  }
+
+  return result;
 }
 }

Source/Core/Common/NandPaths.h

@@ -15,9 +15,6 @@ static const std::string TITLEID_SYSMENU_STRING = "0000000100000002";
 
 namespace Common
 {
-typedef std::pair<char, std::string> replace_t;
-typedef std::vector<replace_t> replace_v;
-
 void InitializeWiiRoot(bool use_temporary);
 void ShutdownWiiRoot();
 
@@ -33,5 +30,11 @@ std::string GetTitleDataPath(u64 _titleID, FromWhichRoot from);
 std::string GetTitleContentPath(u64 _titleID, FromWhichRoot from);
 bool CheckTitleTMD(u64 _titleID, FromWhichRoot from);
 bool CheckTitleTIK(u64 _titleID, FromWhichRoot from);
-void ReadReplacements(replace_v& replacements);
+
+// Escapes characters that are invalid or have special meanings in the host file system
+std::string EscapeFileName(const std::string& filename);
+// Escapes characters that are invalid or have special meanings in the host file system
+std::string EscapePath(const std::string& path);
+// Reverses escaping done by EscapeFileName
+std::string UnescapeFileName(const std::string& filename);
 }

Source/Core/Common/StringUtil.cpp

@@ -10,7 +10,9 @@
 #include <cstring>
 #include <iomanip>
 #include <istream>
+#include <iterator>
 #include <limits.h>
+#include <sstream>
 #include <string>
 #include <vector>
 
@@ -328,6 +330,21 @@ void SplitString(const std::string& str, const char delim, std::vector<std::stri
   output.pop_back();
 }
 
+std::string JoinStrings(const std::vector<std::string>& strings, const std::string& delimiter)
+{
+  // Check if we can return early, just for speed
+  if (strings.empty())
+    return "";
+
+  std::stringstream res;
+  std::copy(strings.begin(), strings.end(),
+            std::ostream_iterator<std::string>(res, delimiter.c_str()));
+
+  // Drop the trailing delimiter.
+  std::string joined = res.str();
+  return joined.substr(0, joined.length() - delimiter.length());
+}
+
 std::string TabsToSpaces(int tab_size, const std::string& in)
 {
   const std::string spaces(tab_size, ' ');

Source/Core/Common/StringUtil.h

@@ -106,6 +106,7 @@ bool AsciiToHex(const std::string& _szValue, u32& result);
 std::string TabsToSpaces(int tab_size, const std::string& in);
 
 void SplitString(const std::string& str, char delim, std::vector<std::string>& output);
+std::string JoinStrings(const std::vector<std::string>& strings, const std::string& delimiter);
 
 // "C:/Windows/winhelp.exe" to "C:/Windows/", "winhelp", ".exe"
 bool SplitPath(const std::string& full_path, std::string* _pPath, std::string* _pFilename,

Source/Core/Core/HW/GCMemcard.h

@@ -157,24 +157,7 @@ struct DEntry
   {
     std::string filename = std::string((char*)Makercode, 2) + '-' +
                            std::string((char*)Gamecode, 4) + '-' + (char*)Filename + ".gci";
-    static Common::replace_v replacements;
+    return Common::EscapeFileName(filename);
-    if (replacements.size() == 0)
-    {
-      Common::ReadReplacements(replacements);
-      // Cannot add \r to replacements file due to it being a line ending char
-      // / might be ok, but we need to verify that this is only used on filenames
-      // as it is a dir_sep
-      replacements.push_back(std::make_pair('\r', std::string("__0d__")));
-      replacements.push_back(std::make_pair('/', std::string("__2f__")));
-    }
-
-    // Replaces chars that FAT32 can't support with strings defined in /sys/replace
-    for (auto& replacement : replacements)
-    {
-      for (size_t j = 0; (j = filename.find(replacement.first, j)) != filename.npos; ++j)
-        filename.replace(j, 1, replacement.second);
-    }
-    return filename;
   }
 
   u8 Gamecode[4];   // 0x00       0x04    Gamecode

Source/Core/Core/HW/WiiSaveCrypted.cpp

@@ -30,8 +30,6 @@
 
 #include "Core/HW/WiiSaveCrypted.h"
 
-static Common::replace_v replacements;
-
 const u8 CWiiSaveCrypted::s_sd_key[16] = {0xAB, 0x01, 0xB9, 0xD8, 0xE1, 0x62, 0x2B, 0x08,
                                           0xAF, 0xBA, 0xD8, 0x4D, 0xBF, 0xC2, 0xA5, 0x5D};
 const u8 CWiiSaveCrypted::s_md5_blanker[16] = {0x0E, 0x65, 0x37, 0x81, 0x99, 0xBE, 0x45, 0x17,
@@ -102,7 +100,6 @@ void CWiiSaveCrypted::ExportAllSaves()
 CWiiSaveCrypted::CWiiSaveCrypted(const std::string& filename, u64 title_id)
     : m_encrypted_save_path(filename), m_title_id(title_id)
 {
-  Common::ReadReplacements(replacements);
   memcpy(m_sd_iv, "\x21\x67\x12\xE6\xAA\x1F\x68\x9F\x95\xC5\xA2\x23\x24\xDC\x6A\x98", 0x10);
 
   if (!title_id)  // Import
@@ -340,12 +337,8 @@ void CWiiSaveCrypted::ImportWiiSaveFiles()
     }
     else
     {
-      std::string filename((char*)file_hdr_tmp.name);
+      std::string filename =
-      for (const Common::replace_t& replacement : replacements)
+          Common::EscapeFileName(reinterpret_cast<const char*>(file_hdr_tmp.name));
-      {
-        for (size_t j = 0; (j = filename.find(replacement.first, j)) != filename.npos; ++j)
-          filename.replace(j, 1, replacement.second);
-      }
 
       std::string file_path_full = m_wii_title_path + filename;
       File::CreateFullPath(file_path_full);
@@ -388,7 +381,6 @@ void CWiiSaveCrypted::ExportWiiSaveFiles()
   for (u32 i = 0; i < m_files_list_size; i++)
   {
     FileHDR file_hdr_tmp;
-    std::string name;
     memset(&file_hdr_tmp, 0, FILE_HDR_SZ);
 
     u32 file_size = 0;
@@ -407,15 +399,8 @@ void CWiiSaveCrypted::ExportWiiSaveFiles()
     file_hdr_tmp.size = Common::swap32(file_size);
     file_hdr_tmp.Permissions = 0x3c;
 
-    name = m_files_list[i].substr(m_wii_title_path.length() + 1);
+    std::string name =
-
+        Common::UnescapeFileName(m_files_list[i].substr(m_wii_title_path.length() + 1));
-    for (const Common::replace_t& repl : replacements)
-    {
-      for (size_t j = 0; (j = name.find(repl.second, j)) != name.npos; ++j)
-      {
-        name.replace(j, repl.second.length(), 1, repl.first);
-      }
-    }
 
     if (name.length() > 0x44)
     {

Source/Core/Core/IPC_HLE/WII_IPC_HLE.cpp

@@ -441,7 +441,7 @@ void ExecuteCommand(u32 address)
           result = IWII_IPC_HLE_Device::GetDefaultReply();
         }
       }
-      else
+      else if (device_name.find('/') == 0)
       {
         device = CreateFileIO(DeviceID, device_name);
         result = device->Open(address, Mode);
@@ -449,9 +449,13 @@ void ExecuteCommand(u32 address)
         DEBUG_LOG(WII_IPC_FILEIO, "IOP: Open File (Device=%s, ID=%08x, Mode=%i)",
                   device->GetDeviceName().c_str(), DeviceID, Mode);
         if (Memory::Read_U32(address + 4) == (u32)DeviceID)
-        {
           s_fdmap[DeviceID] = device;
       }
+      else
+      {
+        WARN_LOG(WII_IPC_HLE, "Invalid device: %s", device_name.c_str());
+        Memory::Write_U32(FS_ENOENT, address + 4);
+        result = IWII_IPC_HLE_Device::GetDefaultReply();
       }
     }
     else

Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_FileIO.cpp

@@ -7,55 +7,27 @@
 #include <memory>
 #include <utility>
 
+#include "Common/Assert.h"
 #include "Common/ChunkFile.h"
 #include "Common/CommonTypes.h"
 #include "Common/FileUtil.h"
-#include "Common/Logging/Log.h"
-#include "Common/MsgHandler.h"
 #include "Common/NandPaths.h"
 #include "Core/HW/Memmap.h"
 #include "Core/IPC_HLE/WII_IPC_HLE.h"
 #include "Core/IPC_HLE/WII_IPC_HLE_Device_FileIO.h"
 #include "Core/IPC_HLE/WII_IPC_HLE_Device_fs.h"
 
-static Common::replace_v replacements;
-
 static std::map<std::string, std::weak_ptr<File::IOFile>> openFiles;
 
 // This is used by several of the FileIO and /dev/fs functions
-std::string HLE_IPC_BuildFilename(std::string path_wii)
+std::string HLE_IPC_BuildFilename(const std::string& wii_path)
 {
-  // Replaces chars that FAT32 can't support with strings defined in /sys/replace
+  std::string nand_path = File::GetUserPath(D_SESSION_WIIROOT_IDX);
-  for (auto& replacement : replacements)
+  if (wii_path.compare(0, 1, "/") == 0)
-  {
+    return nand_path + Common::EscapePath(wii_path);
-    for (size_t j = 0; (j = path_wii.find(replacement.first, j)) != path_wii.npos; ++j)
-      path_wii.replace(j, 1, replacement.second);
-  }
 
-  const std::string root_path = File::GetUserPath(D_SESSION_WIIROOT_IDX);
+  _assert_(false);
-  const std::string full_path = root_path + path_wii;
+  return nand_path;
-
-  const std::string absolute_root_path = File::GetAbsolutePath(root_path);
-  const std::string absolute_full_path = File::GetAbsolutePath(full_path);
-  if (absolute_root_path.empty() || absolute_full_path.empty())
-  {
-    PanicAlert("IOS HLE: Couldn't get an absolute path; the root directory will be returned. "
-               "This will most likely lead to failures.");
-    return root_path;
-  }
-
-  if (path_wii.empty() || path_wii[0] != '/' ||
-      absolute_full_path.compare(0, absolute_root_path.size(), absolute_root_path) != 0)
-  {
-    // Prevent the emulated system from accessing files that aren't in the NAND directory.
-    // (Emulated software that tries to exploit Dolphin might access a path like "/../..".)
-    WARN_LOG(WII_IPC_FILEIO,
-             "The emulated software tried to access a file outside of the NAND directory: %s",
-             absolute_full_path.c_str());
-    return root_path;
-  }
-
-  return full_path;
 }
 
 void HLE_IPC_CreateVirtualFATFilesystem()
@@ -97,7 +69,6 @@ CWII_IPC_HLE_Device_FileIO::CWII_IPC_HLE_Device_FileIO(u32 device_id,
                                                        const std::string& device_name)
     : IWII_IPC_HLE_Device(device_id, device_name, false)  // not a real hardware
 {
-  Common::ReadReplacements(replacements);
 }
 
 CWII_IPC_HLE_Device_FileIO::~CWII_IPC_HLE_Device_FileIO()

Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_FileIO.h

@@ -18,7 +18,7 @@ namespace File
 class IOFile;
 }
 
-std::string HLE_IPC_BuildFilename(std::string _pFilename);
+std::string HLE_IPC_BuildFilename(const std::string& wii_path);
 void HLE_IPC_CreateVirtualFATFilesystem();
 
 class CWII_IPC_HLE_Device_FileIO : public IWII_IPC_HLE_Device

Source/Core/Core/IPC_HLE/WII_IPC_HLE_Device_fs.cpp

@@ -22,12 +22,14 @@
 #include "Core/IPC_HLE/WII_IPC_HLE_Device_FileIO.h"
 #include "Core/IPC_HLE/WII_IPC_HLE_Device_fs.h"
 
-static Common::replace_v replacements;
+static bool IsValidWiiPath(const std::string& path)
+{
+  return path.compare(0, 1, "/") == 0;
+}
 
 CWII_IPC_HLE_Device_fs::CWII_IPC_HLE_Device_fs(u32 _DeviceID, const std::string& _rDeviceName)
     : IWII_IPC_HLE_Device(_DeviceID, _rDeviceName)
 {
-  Common::ReadReplacements(replacements);
 }
 
 CWII_IPC_HLE_Device_fs::~CWII_IPC_HLE_Device_fs()
@@ -96,9 +98,18 @@ IPCCommandResult CWII_IPC_HLE_Device_fs::IOCtlV(u32 _CommandAddress)
   {
   case IOCTLV_READ_DIR:
   {
+    const std::string relative_path =
+        Memory::GetString(CommandBuffer.InBuffer[0].m_Address, CommandBuffer.InBuffer[0].m_Size);
+
+    if (!IsValidWiiPath(relative_path))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", relative_path.c_str());
+      ReturnValue = FS_RESULT_FATAL;
+      break;
+    }
+
     // the Wii uses this function to define the type (dir or file)
-    std::string DirName(HLE_IPC_BuildFilename(
+    std::string DirName(HLE_IPC_BuildFilename(relative_path));
-        Memory::GetString(CommandBuffer.InBuffer[0].m_Address, CommandBuffer.InBuffer[0].m_Size)));
 
     INFO_LOG(WII_IPC_FILEIO, "FS: IOCTL_READ_DIR %s", DirName.c_str());
 
@@ -132,10 +143,9 @@ IPCCommandResult CWII_IPC_HLE_Device_fs::IOCtlV(u32 _CommandAddress)
     {
       for (File::FSTEntry& child : entry.children)
       {
-        // Decode entities of invalid file system characters so that
+        // Decode escaped invalid file system characters so that games (such as
-        // games (such as HP:HBP) will be able to find what they expect.
+        // Harry Potter and the Half-Blood Prince) can find what they expect.
-        for (const Common::replace_t& r : replacements)
+        child.virtualName = Common::UnescapeFileName(child.virtualName);
-          child.virtualName = ReplaceAll(child.virtualName, r.second, {r.first});
       }
 
       std::sort(entry.children.begin(), entry.children.end(),
@@ -181,6 +191,14 @@ IPCCommandResult CWII_IPC_HLE_Device_fs::IOCtlV(u32 _CommandAddress)
     // It should be correct, but don't count on it...
     std::string relativepath =
         Memory::GetString(CommandBuffer.InBuffer[0].m_Address, CommandBuffer.InBuffer[0].m_Size);
+
+    if (!IsValidWiiPath(relativepath))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", relativepath.c_str());
+      ReturnValue = FS_RESULT_FATAL;
+      break;
+    }
+
     std::string path(HLE_IPC_BuildFilename(relativepath));
     u32 fsBlocks = 0;
     u32 iNodes = 0;
@@ -295,7 +313,13 @@ s32 CWII_IPC_HLE_Device_fs::ExecuteCommand(u32 _Parameter, u32 _BufferIn, u32 _B
     Addr += 4;
     u16 GroupID = Memory::Read_U16(Addr);
     Addr += 2;
-    std::string DirName(HLE_IPC_BuildFilename(Memory::GetString(Addr, 64)));
+    const std::string wii_path = Memory::GetString(Addr, 64);
+    if (!IsValidWiiPath(wii_path))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", wii_path.c_str());
+      return FS_RESULT_FATAL;
+    }
+    std::string DirName(HLE_IPC_BuildFilename(wii_path));
     Addr += 64;
     Addr += 9;  // owner attribs, permission
     u8 Attribs = Memory::Read_U8(Addr);
@@ -320,7 +344,13 @@ s32 CWII_IPC_HLE_Device_fs::ExecuteCommand(u32 _Parameter, u32 _BufferIn, u32 _B
     Addr += 4;
     u16 GroupID = Memory::Read_U16(Addr);
     Addr += 2;
-    std::string Filename = HLE_IPC_BuildFilename(Memory::GetString(_BufferIn, 64));
+    const std::string wii_path = Memory::GetString(_BufferIn, 64);
+    if (!IsValidWiiPath(wii_path))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", wii_path.c_str());
+      return FS_RESULT_FATAL;
+    }
+    std::string Filename = HLE_IPC_BuildFilename(wii_path);
     Addr += 64;
     u8 OwnerPerm = Memory::Read_U8(Addr);
     Addr += 1;
@@ -352,7 +382,13 @@ s32 CWII_IPC_HLE_Device_fs::ExecuteCommand(u32 _Parameter, u32 _BufferIn, u32 _B
     u32 OwnerID = 0;
     u16 GroupID = 0x3031;  // this is also known as makercd, 01 (0x3031) for nintendo and 08
                            // (0x3038) for MH3 etc
-    std::string Filename = HLE_IPC_BuildFilename(Memory::GetString(_BufferIn, 64));
+    const std::string wii_path = Memory::GetString(_BufferIn, 64);
+    if (!IsValidWiiPath(wii_path))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", wii_path.c_str());
+      return FS_RESULT_FATAL;
+    }
+    std::string Filename = HLE_IPC_BuildFilename(wii_path);
     u8 OwnerPerm = 0x3;    // read/write
     u8 GroupPerm = 0x3;    // read/write
     u8 OtherPerm = 0x3;    // read/write
@@ -405,7 +441,13 @@ s32 CWII_IPC_HLE_Device_fs::ExecuteCommand(u32 _Parameter, u32 _BufferIn, u32 _B
     _dbg_assert_(WII_IPC_FILEIO, _BufferOutSize == 0);
     int Offset = 0;
 
-    std::string Filename = HLE_IPC_BuildFilename(Memory::GetString(_BufferIn + Offset, 64));
+    const std::string wii_path = Memory::GetString(_BufferIn + Offset, 64);
+    if (!IsValidWiiPath(wii_path))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", wii_path.c_str());
+      return FS_RESULT_FATAL;
+    }
+    std::string Filename = HLE_IPC_BuildFilename(wii_path);
     Offset += 64;
     if (File::Delete(Filename))
     {
@@ -429,10 +471,22 @@ s32 CWII_IPC_HLE_Device_fs::ExecuteCommand(u32 _Parameter, u32 _BufferIn, u32 _B
     _dbg_assert_(WII_IPC_FILEIO, _BufferOutSize == 0);
     int Offset = 0;
 
-    std::string Filename = HLE_IPC_BuildFilename(Memory::GetString(_BufferIn + Offset, 64));
+    const std::string wii_path = Memory::GetString(_BufferIn + Offset, 64);
+    if (!IsValidWiiPath(wii_path))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", wii_path.c_str());
+      return FS_RESULT_FATAL;
+    }
+    std::string Filename = HLE_IPC_BuildFilename(wii_path);
     Offset += 64;
 
-    std::string FilenameRename = HLE_IPC_BuildFilename(Memory::GetString(_BufferIn + Offset, 64));
+    const std::string wii_path_rename = Memory::GetString(_BufferIn + Offset, 64);
+    if (!IsValidWiiPath(wii_path_rename))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", wii_path_rename.c_str());
+      return FS_RESULT_FATAL;
+    }
+    std::string FilenameRename = HLE_IPC_BuildFilename(wii_path_rename);
     Offset += 64;
 
     // try to make the basis directory
@@ -469,7 +523,13 @@ s32 CWII_IPC_HLE_Device_fs::ExecuteCommand(u32 _Parameter, u32 _BufferIn, u32 _B
     Addr += 4;
     u16 GroupID = Memory::Read_U16(Addr);
     Addr += 2;
-    std::string Filename(HLE_IPC_BuildFilename(Memory::GetString(Addr, 64)));
+    const std::string wii_path = Memory::GetString(Addr, 64);
+    if (!IsValidWiiPath(wii_path))
+    {
+      WARN_LOG(WII_IPC_FILEIO, "Not a valid path: %s", wii_path.c_str());
+      return FS_RESULT_FATAL;
+    }
+    std::string Filename(HLE_IPC_BuildFilename(wii_path));
     Addr += 64;
     u8 OwnerPerm = Memory::Read_U8(Addr);
     Addr++;

Source/UnitTests/Common/CMakeLists.txt

@@ -8,4 +8,6 @@ add_dolphin_test(FifoQueueTest FifoQueueTest.cpp)
 add_dolphin_test(FixedSizeQueueTest FixedSizeQueueTest.cpp)
 add_dolphin_test(FlagTest FlagTest.cpp)
 add_dolphin_test(MathUtilTest MathUtilTest.cpp)
+add_dolphin_test(NandPathsTest NandPathsTest.cpp)
+add_dolphin_test(StringUtilTest StringUtilTest.cpp)
 add_dolphin_test(x64EmitterTest x64EmitterTest.cpp)

Source/UnitTests/Common/NandPathsTest.cpp

@@ -0,0 +1,42 @@
+// Copyright 2016 Dolphin Emulator Project
+// Licensed under GPLv2+
+// Refer to the license.txt file included.
+
+#include <gtest/gtest.h>
+#include <string>
+
+#include "Common/NandPaths.h"
+
+static void TestEscapeAndUnescape(const std::string& unescaped, const std::string& escaped)
+{
+  EXPECT_EQ(escaped, Common::EscapeFileName(unescaped));
+  EXPECT_EQ(unescaped, Common::UnescapeFileName(escaped));
+}
+
+TEST(NandPaths, EscapeUnescape)
+{
+  EXPECT_EQ("/a/__2e__/b/__3e__", Common::EscapePath("/a/./b/>"));
+  EXPECT_EQ("/a/__2e____2e__/b/__3e__", Common::EscapePath("/a/../b/>"));
+  EXPECT_EQ("/a/__2e____2e____2e__/b/__3e__", Common::EscapePath("/a/.../b/>"));
+  EXPECT_EQ("/a/__2e____2e____2e____2e__/b/__3e__", Common::EscapePath("/a/..../b/>"));
+
+  EXPECT_EQ("", Common::EscapePath(""));
+  TestEscapeAndUnescape("", "");
+
+  TestEscapeAndUnescape("regular string", "regular string");
+  TestEscapeAndUnescape("a/../1b|", "a__2f__..__2f__1b__7c__");
+  TestEscapeAndUnescape("__22__", "__5f____5f__22__5f____5f__");
+
+  // The \0 can't be written in a regular string literal, otherwise it'll be treated as the end
+  TestEscapeAndUnescape(std::string{'\0'} +
+                            "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+                            "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+                            "\"*/:<>?\\_|\x7f",
+                        "__00____01____02____03____04____05____06____07__"
+                        "__08____09____0a____0b____0c____0d____0e____0f__"
+                        "__10____11____12____13____14____15____16____17__"
+                        "__18____19____1a____1b____1c____1d____1e____1f__"
+                        "__22____2a____2f____3a____3c____3e____3f____5c_____7c____7f__");
+  //                                                                     ^
+  // There is a normal underscore here (not part of an escape sequence): |
+}

Source/UnitTests/Common/StringUtilTest.cpp

@@ -0,0 +1,18 @@
+// Copyright 2016 Dolphin Emulator Project
+// Licensed under GPLv2+
+// Refer to the license.txt file included.
+
+#include <gtest/gtest.h>
+#include <string>
+#include <vector>
+
+#include "Common/StringUtil.h"
+
+TEST(StringUtil, JoinStrings)
+{
+  EXPECT_EQ("", JoinStrings({}, ", "));
+  EXPECT_EQ("a", JoinStrings({"a"}, ","));
+  EXPECT_EQ("ab", JoinStrings({"a", "b"}, ""));
+  EXPECT_EQ("a, bb, c", JoinStrings({"a", "bb", "c"}, ", "));
+  EXPECT_EQ("???", JoinStrings({"?", "?"}, "?"));
+}