From 98a82cd4847160f41e728403efee51ebc4d2b60a Mon Sep 17 00:00:00 2001
From: timoreo <contact@timoreo.fr>
Date: Fri, 1 Jul 2022 14:03:45 +0200
Subject: [PATCH] Fix MMCZip bugs

Signed-off-by: timoreo <contact@timoreo.fr>
---
 launcher/MMCZip.cpp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/launcher/MMCZip.cpp b/launcher/MMCZip.cpp
index 9f4e968f7..3b5c44425 100644
--- a/launcher/MMCZip.cpp
+++ b/launcher/MMCZip.cpp
@@ -300,6 +300,11 @@ std::optional<QStringList> MMCZip::extractSubDir(QuaZip *zip, const QString & su
         name.remove(0, subdir.size());
         auto original_name = name;
 
+        // Fix subdirs/files ending with a / getting transformed into absolute paths
+        if(name.startsWith('/')){
+            name = name.mid(1);
+        }
+
         // Fix weird "folders with a single file get squashed" thing
         QString path;
         if(name.contains('/') && !name.endsWith('/')){
@@ -319,6 +324,11 @@ std::optional<QStringList> MMCZip::extractSubDir(QuaZip *zip, const QString & su
             absFilePath = directory.absoluteFilePath(path + name);
         }
 
+        //Block potential file traversal issues
+        if(!absFilePath.startsWith(directory.absolutePath())){
+            qWarning() << "Potential file traversal issue, for path " << absFilePath << " with base name as " << directory.absolutePath();
+            continue;
+        }
         if (!JlCompress::extractFile(zip, "", absFilePath))
         {
             qWarning() << "Failed to extract file" << original_name << "to" << absFilePath;