diff --git a/launcher/MMCZip.cpp b/launcher/MMCZip.cpp index 9f4e968f7..3b5c44425 100644 --- a/launcher/MMCZip.cpp +++ b/launcher/MMCZip.cpp @@ -300,6 +300,11 @@ std::optional MMCZip::extractSubDir(QuaZip *zip, const QString & su name.remove(0, subdir.size()); auto original_name = name; + // Fix subdirs/files ending with a / getting transformed into absolute paths + if(name.startsWith('/')){ + name = name.mid(1); + } + // Fix weird "folders with a single file get squashed" thing QString path; if(name.contains('/') && !name.endsWith('/')){ @@ -319,6 +324,11 @@ std::optional MMCZip::extractSubDir(QuaZip *zip, const QString & su absFilePath = directory.absoluteFilePath(path + name); } + //Block potential file traversal issues + if(!absFilePath.startsWith(directory.absolutePath())){ + qWarning() << "Potential file traversal issue, for path " << absFilePath << " with base name as " << directory.absolutePath(); + continue; + } if (!JlCompress::extractFile(zip, "", absFilePath)) { qWarning() << "Failed to extract file" << original_name << "to" << absFilePath;