diff options
| -rw-r--r-- | src/main/java/io/github/moulberry/notenoughupdates/NEUManager.java | 34 | ||||
| -rw-r--r-- | src/main/java/io/github/moulberry/notenoughupdates/commands/Commands.java | 11 |
2 files changed, 35 insertions, 10 deletions
diff --git a/src/main/java/io/github/moulberry/notenoughupdates/NEUManager.java b/src/main/java/io/github/moulberry/notenoughupdates/NEUManager.java index e5497cd0..614884d9 100644 --- a/src/main/java/io/github/moulberry/notenoughupdates/NEUManager.java +++ b/src/main/java/io/github/moulberry/notenoughupdates/NEUManager.java @@ -3,6 +3,7 @@ package io.github.moulberry.notenoughupdates; import com.google.gson.*; import io.github.moulberry.notenoughupdates.auction.APIManager; import io.github.moulberry.notenoughupdates.miscgui.GuiItemRecipe; +import io.github.moulberry.notenoughupdates.options.NEUConfig; import io.github.moulberry.notenoughupdates.recipes.CraftingOverlay; import io.github.moulberry.notenoughupdates.recipes.CraftingRecipe; import io.github.moulberry.notenoughupdates.recipes.Ingredient; @@ -1034,6 +1035,9 @@ public class NEUManager { File newFile = new File(destDir + File.separator + fileName); //create directories for sub directories in zip new File(newFile.getParent()).mkdirs(); + if (!isInTree(dir, newFile)) { + throw new RuntimeException("Not Enough Updates detected an invalid zip file. This is a potential security risk, please report this in the Moulberry discord."); + } FileOutputStream fos = new FileOutputStream(newFile); int len; while ((len = zis.read(buffer)) > 0) { @@ -1054,6 +1058,16 @@ public class NEUManager { } } + private static boolean isInTree(File rootDirectory, File file) throws IOException { + file = file.getCanonicalFile(); + rootDirectory = rootDirectory.getCanonicalFile(); + while (file != null) { + if (file.equals(rootDirectory)) return true; + file = file.getParentFile(); + } + return false; + } + /** * Modified from https://www.journaldev.com/960/java-unzip-file-example */ @@ -1067,6 +1081,9 @@ public class NEUManager { if (!ze.isDirectory()) { String fileName = ze.getName(); File newFile = new File(dest, fileName); + if (!isInTree(dest, newFile)) { + throw new RuntimeException("Not Enough Updates detected an invalid zip file. This is a potential security risk, please report this in the Moulberry discord."); + } //create directories for sub directories in zip new File(newFile.getParent()).mkdirs(); FileOutputStream fos = new FileOutputStream(newFile); @@ -1438,4 +1455,21 @@ public class NEUManager { return stack; } } + + public void reloadRepository() { + File items = new File(repoLocation, "items"); + if (items.exists()) { + recipes.clear(); + recipesMap.clear(); + usagesMap.clear(); + + File[] itemFiles = new File(repoLocation, "items").listFiles(); + if (itemFiles != null) { + for (File f : itemFiles) { + String internalname = f.getName().substring(0, f.getName().length() - 5); + loadItem(internalname); + } + } + } + } } diff --git a/src/main/java/io/github/moulberry/notenoughupdates/commands/Commands.java b/src/main/java/io/github/moulberry/notenoughupdates/commands/Commands.java index 37fe5f63..d3fd7e0c 100644 --- a/src/main/java/io/github/moulberry/notenoughupdates/commands/Commands.java +++ b/src/main/java/io/github/moulberry/notenoughupdates/commands/Commands.java @@ -362,16 +362,7 @@ public class Commands { SimpleCommand reloadRepoCommand = new SimpleCommand("neureloadrepo", new SimpleCommand.ProcessCommandRunnable() { public void processCommand(ICommandSender sender, String[] args) { - File items = new File(NotEnoughUpdates.INSTANCE.manager.repoLocation, "items"); - if (items.exists()) { - File[] itemFiles = new File(NotEnoughUpdates.INSTANCE.manager.repoLocation, "items").listFiles(); - if (itemFiles != null) { - for (File f : itemFiles) { - String internalname = f.getName().substring(0, f.getName().length() - 5); - NotEnoughUpdates.INSTANCE.manager.loadItem(internalname); - } - } - } + NotEnoughUpdates.INSTANCE.manager.reloadRepository(); Constants.reload(); NotEnoughUpdates.INSTANCE.newConfigFile(); |