diff options
| author | Admiral H. Curtiss <pikachu025@gmail.com> | 2026-06-04 17:31:33 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-06-04 17:31:33 +0200 |
| commit | aabea5b1e3f13177aa302f99b435a70ad6a9b0b1 (patch) | |
| tree | 45c6d03b99be09c6a5a13a2c9ad940bbbc2e612f /Source | |
| parent | 07aeb593211c7a427d81f0c29ec4a74783f1851e (diff) | |
| parent | 2faa9760d3e689ceb5b92f71e29a4a869b9f50f9 (diff) | |
Merge pull request #14667 from JosJuice/nand-import-path-traversal
Prevent path traversal in NANDImporter::ProcessEntry
Diffstat (limited to 'Source')
| -rw-r--r-- | Source/Core/DiscIO/NANDImporter.cpp | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/Source/Core/DiscIO/NANDImporter.cpp b/Source/Core/DiscIO/NANDImporter.cpp index f4c94bbb2c..4477621984 100644 --- a/Source/Core/DiscIO/NANDImporter.cpp +++ b/Source/Core/DiscIO/NANDImporter.cpp @@ -11,6 +11,7 @@ #include "Common/IOFile.h" #include "Common/Logging/Log.h" #include "Common/MsgHandler.h" +#include "Common/NandPaths.h" #include "Core/IOS/ES/Formats.h" namespace DiscIO @@ -134,11 +135,7 @@ bool NANDImporter::ExtractFiles() std::string NANDImporter::GetPath(const NANDFSTEntry& entry, const std::string& parent_path) { std::string name(entry.name, strnlen(entry.name, sizeof(NANDFSTEntry::name))); - - if (name.front() == '/' || parent_path.back() == '/') - return parent_path + name; - - return parent_path + '/' + name; + return parent_path + '/' + Common::EscapeFileName(name); } bool NANDImporter::ProcessEntry(u16 entry_number, const std::string& parent_path) @@ -153,7 +150,7 @@ bool NANDImporter::ProcessEntry(u16 entry_number, const std::string& parent_path const NANDFSTEntry entry = m_superblock->fst[entry_number]; - const std::string path = GetPath(entry, parent_path); + const std::string path = entry_number == 0 ? parent_path : GetPath(entry, parent_path); INFO_LOG_FMT(DISCIO, "Entry: {} Path: {}", entry, path); Type type = static_cast<Type>(entry.mode & 3); |