From d4d56f004a528ea0cada526132dd77bd410a8fe7 Mon Sep 17 00:00:00 2001 From: AndreyL ProductEngine Date: Wed, 19 Apr 2017 21:19:04 +0300 Subject: MAINT-7074 Fixed ability to escape from skin directory with --- indra/llvfs/lldir.cpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'indra/llvfs') diff --git a/indra/llvfs/lldir.cpp b/indra/llvfs/lldir.cpp index 86a15f2ef2..924e1166ee 100644 --- a/indra/llvfs/lldir.cpp +++ b/indra/llvfs/lldir.cpp @@ -720,6 +720,15 @@ std::vector LLDir::findSkinnedFilenames(const std::string& subdir, << ((constraint == CURRENT_SKIN)? "CURRENT_SKIN" : "ALL_SKINS") << LL_ENDL; + // Build results vector. + std::vector results; + // Disallow filenames that may escape subdir + if (filename.find("..") != std::string::npos) + { + LL_WARNS("LLDir") << "Ignoring potentially relative filename '" << filename << "'" << LL_ENDL; + return results; + } + // Cache the default language directory for each subdir we've encountered. // A cache entry whose value is the empty string means "not localized, // don't bother checking again." @@ -784,8 +793,6 @@ std::vector LLDir::findSkinnedFilenames(const std::string& subdir, } } - // Build results vector. - std::vector results; // The process we use depends on 'constraint'. if (constraint != CURRENT_SKIN) // meaning ALL_SKINS { -- cgit v1.2.3