Merge pull request #9759 from Techjar/netplay-sanitize-gci

NetPlay: Check file names when receiving GCI folder

1 files changed, 15 insertions, 3 deletions

diff --git a/Source/Core/Common/NandPaths.cpp b/Source/Core/Common/NandPaths.cpp
index ac57ccdcdc..502146f2d6 100644
--- a/Source/Core/Common/NandPaths.cpp
+++ b/Source/Core/Common/NandPaths.cpp
@@ -95,6 +95,13 @@ bool IsTitlePath(const std::string& path, std::optional<FromWhichRoot> from, u64
   return true;
 }
 
+static bool IsIllegalCharacter(char c)
+{
+  static const std::unordered_set<char> illegal_chars = {'\"', '*', '/',  ':', '<',
+                                                         '>',  '?', '\\', '|', '\x7f'};
+  return (c >= 0 && c <= 0x1F) || illegal_chars.find(c) != illegal_chars.end();
+}
+
 std::string EscapeFileName(const std::string& filename)
 {
   // Prevent paths from containing special names like ., .., ..., ...., and so on
@@ -105,13 +112,11 @@ std::string EscapeFileName(const std::string& filename)
   std::string filename_with_escaped_double_underscores = ReplaceAll(filename, "__", "__5f____5f__");
 
   // Escape all other characters that need to be escaped
-  static const std::unordered_set<char> chars_to_replace = {'\"', '*', '/',  ':', '<',
-                                                            '>',  '?', '\\', '|', '\x7f'};
   std::string result;
   result.reserve(filename_with_escaped_double_underscores.size());
   for (char c : filename_with_escaped_double_underscores)
   {
-    if ((c >= 0 && c <= 0x1F) || chars_to_replace.find(c) != chars_to_replace.end())
+    if (IsIllegalCharacter(c))
       result.append(fmt::format("__{:02x}__", c));
     else
       result.push_back(c);
@@ -151,4 +156,11 @@ std::string UnescapeFileName(const std::string& filename)
 
   return result;
 }
+
+bool IsFileNameSafe(const std::string_view filename)
+{
+  return !filename.empty() &&
+         !std::all_of(filename.begin(), filename.end(), [](char c) { return c == '.'; }) &&
+         std::none_of(filename.begin(), filename.end(), IsIllegalCharacter);
+}
 }  // namespace Common