Skip to content
Snippets Groups Projects
Commit 3c66e24d authored by wolfs's avatar wolfs Committed by Luna
Browse files

Implement file type whitelist, completely remove popen and pclose

This is probably super inefficient. Someone please teach me how2C.
parent 4e20a148
No related branches found
No related tags found
No related merge requests found
......@@ -25,6 +25,13 @@
static const char *const fnames[] = {"input", "output"};
static const char *whitelist[] = { // Allow scripters to write files of these types to SRB2's folder
".txt",
".sav2",
".cfg",
".png",
".bmp"
};
static int pushresult (lua_State *L, int i, const char *filename) {
......@@ -102,17 +109,6 @@ static int io_noclose (lua_State *L) {
}
/*
** function to close 'popen' files
*/
static int io_pclose (lua_State *L) {
FILE **p = tofilep(L);
int ok = lua_pclose(L, *p);
*p = NULL;
return pushresult(L, ok, NULL);
}
/*
** function to close regular files
*/
......@@ -160,7 +156,17 @@ static int io_tostring (lua_State *L) {
static int io_open (lua_State *L) {
const char *filename = luaL_checkstring(L, 1);
if (strstr(filename, "../") || strstr(filename, "..\\"))
int pass = 0; int i;
int length = strlen(filename) - 1;
for (i = 0; i < 5; i++) // wolfs == noobcoder, so manually change this with any added file types
{
if (!stricmp(&filename[length - (strlen(whitelist[i]) - 1)], whitelist[i]))
{
pass = 1;
break;
}
}
if (strstr(filename, "../") || strstr(filename, "..\\") || !pass)
{
luaL_error(L,"access denied to %s", filename);
return pushresult(L,0,filename);
......@@ -535,10 +541,6 @@ LUALIB_API int luaopen_io (lua_State *L) {
createstdfile(L, stdout, IO_OUTPUT, "stdout");
createstdfile(L, stderr, 0, "stderr");
lua_pop(L, 1); /* pop environment for default files */
lua_getfield(L, -1, "popen");
newfenv(L, io_pclose); /* create environment for 'popen' */
lua_setfenv(L, -2); /* set fenv for 'popen' */
lua_pop(L, 1); /* pop 'popen' */
return 1;
}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment