Skip to content
Snippets Groups Projects
Commit 64a903eb authored by Rob Swindell's avatar Rob Swindell :speech_balloon:
Browse files

Fail on "disallowed filename" after filtering for filename/pattern

Extracting a file_id.diz would fail if the file contained any disallowed filenames before the DIZ, e.g.:
 Error: disallowed filename '_blockmen_res[v]olution.ans' (after extracting 0 items successfully)
parent 237ace32
No related branches found
No related tags found
1 merge request!463MRC mods by Codefenix (2024-10-20)
Pipeline #1965 passed
......@@ -810,12 +810,6 @@ long extract_files_from_archive(const char* archive, const char* outdir, const c
if(filetype != AE_IFREG)
continue;
char* filename = getfname(pathname);
if(allowed_filename_chars != NULL
&& *allowed_filename_chars != '\0'
&& strspn(filename, allowed_filename_chars) != strlen(filename)) {
safe_snprintf(error, maxerrlen, "disallowed filename '%s'", pathname);
break;
}
if(!with_path)
pathname = filename;
if(file_list != NULL) {
......@@ -826,6 +820,12 @@ long extract_files_from_archive(const char* archive, const char* outdir, const c
if(file_list[i] == NULL)
continue;
}
if(allowed_filename_chars != NULL
&& *allowed_filename_chars != '\0'
&& strspn(filename, allowed_filename_chars) != strlen(filename)) {
safe_snprintf(error, maxerrlen, "disallowed filename '%s'", pathname);
break;
}
SAFECOPY(fpath, outdir);
backslash(fpath);
SAFECAT(fpath, pathname);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment