removed dangerous filename checks from FRIK_FILE code

added FS_CheckNastyPath function which is called by FS_Open, so now dangerous paths are rejected everywhere

git-svn-id: svn://svn.icculus.org/twilight/trunk/darkplaces@4848 d7cf8633-e32d-0410-b094-e92efae38249

diff --git a/fs.c b/fs.c
index 157a9c7b7cd501c6c92634efd06187b6e363c984..82774b7a415ab21bbcb55d596255e705fbe2ecbc 100644 (file)
--- a/fs.c
+++ b/fs.c
@@ -1126,6 +1126,39 @@ qfile_t *FS_OpenRead (const char *path, int offs, int len)
        return file;
 }
 
+/*
+====================
+FS_CheckNastyPath
+
+Return true if the path should be rejected due to one of the following:
+1: path elements that are non-portable
+2: path elements that would allow access to files outside the game directory,
+   or are just not a good idea for a mod to be using.
+====================
+*/
+int FS_CheckNastyPath (const char *path)
+{
+       // Windows: don't allow \ in filenames (windows-only), period.
+       // (on Windows \ is a directory separator, but / is also supported)
+       if (strstr(path, "\\"))
+               return 1; // non-portable
+       // Mac: don't allow Mac-only filenames - : is a directory separator
+       // instead of /, but we rely on / working already, so there's no reason to
+       // support a Mac-only path
+       // Amiga and Windows: : tries to go to root of drive
+       if (strstr(path, ":"))
+               return 1; // non-portable attempt to go to root of drive
+       // Amiga: // is parent directory
+       if (strstr(path, "//"))
+               return 1; // non-portable attempt to go to parent directory
+       // all: don't allow going to current directory (./) or parent directory (../ or /../)
+       if (strstr(path, "./"))
+               return 2; // attempt to go to parent directory
+       // after all these checks we're pretty sure it's a / separated filename
+       // and won't do much if any harm
+       return false;
+}
+
 
 /*
 ====================
@@ -1317,6 +1350,12 @@ Open a file. The syntax is the same as fopen
 */
 qfile_t* FS_Open (const char* filepath, const char* mode, qboolean quiet)
 {
+       if (FS_CheckNastyPath(filepath))
+       {
+               Con_Printf("FS_Open(\"%s\", \"%s\", %s): nasty filename rejected\n", filepath, mode, quiet ? "true" : "false");
+               return NULL;
+       }
+
        // If the file is opened in "write" or "append" mode
        if (strchr (mode, 'w') || strchr (mode, 'a'))
        {

diff --git a/pr_cmds.c b/pr_cmds.c
index 6de3550b3db8e95d3f9ba68a74abb5e54a024ce7..a888644932c9317dd1caedcb41e493f68c293394 100644 (file)
--- a/pr_cmds.c
+++ b/pr_cmds.c
@@ -2789,7 +2789,7 @@ void PF_stof(void)
 //float(string filename, float mode) fopen = #110; // opens a file inside quake/gamedir/data/ (mode is FILE_READ, FILE_APPEND, or FILE_WRITE), returns fhandle >= 0 if successful, or fhandle < 0 if unable to open file for any reason
 void PF_fopen(void)
 {
-       int filenum, mode, i;
+       int filenum, mode;
        char *modestring, *filename;
        for (filenum = 0;filenum < MAX_PRFILES;filenum++)
                if (pr_files[filenum] == NULL)
@@ -2818,21 +2818,7 @@ void PF_fopen(void)
                return;
        }
        filename = G_STRING(OFS_PARM0);
-       // control characters do not cause issues with any platforms I know of, but they are usually annoying to deal with
-       // ../ is parent directory on many platforms
-       // // is parent directory on Amiga
-       // / at the beginning of a path is root on unix, and parent directory on Amiga
-       // : is root of drive on Amiga (also used as a directory separator on Mac, but / works there too, so that's a bad idea)
-       // \ is a windows-ism (so it's naughty to use it, / works on all platforms)
-       for (i = 0;filename[i];i++)
-       {
-               if (filename[i] < ' ' || (filename[i] == '/' && filename[i+1] == '/') || (filename[i] == '.' && filename[i+1] == '.') || filename[i] == ':' || filename[i] == '\\' || filename[0] == '/')
-               {
-                       Con_Printf("PF_fopen: dangerous/confusing/annoying/non-portable filename \"%s\" not allowed. (contains control characters or // or .. or : or \\ or begins with /)\n", filename);
-                       G_FLOAT(OFS_RETURN) = -4;
-                       return;
-               }
-       }
+       // -4 failure (dangerous/non-portable filename) removed, FS_Open checks
        pr_files[filenum] = FS_Open(va("data/%s", filename), modestring, false);
 
        if (pr_files[filenum] == NULL && modestring == "rb")