RiivolutionPatcher: Protect against three or more dots in path traversal.

This commit is contained in:
Admiral H. Curtiss 2021-10-22 06:27:37 +02:00
parent 22c6f2fe3b
commit fe7f3a6f26
No known key found for this signature in database
GPG Key ID: F051B4C4044F33FB
1 changed files with 7 additions and 0 deletions

View File

@ -98,6 +98,13 @@ FileDataLoaderHostFS::MakeAbsoluteFromRelative(std::string_view external_relativ
result.pop_back();
result.pop_back();
}
else if (std::all_of(element.begin(), element.end(), [](char c) { return c == '.'; }))
{
// This is a triple, quadruple, etc. dot.
// Some file systems treat this as several 'up' path traversals, but Riivolution does not.
// If someone tries this just error out, it wouldn't work sensibly in Riivolution anyway.
return std::nullopt;
}
else
{
// We're going down a level.