RobustToolbox
RobustToolbox copied to clipboard
ResourcePath.Clean / GetFullPath Errors
trafficstars
WritableDirProvider.GetFullPath() has this code snippet:
var relPath = path.Clean().ToRelativeSystemPath();
if (relPath.Contains("\\..") || relPath.Contains("/.."))
{
// Hard cap on any exploit smuggling a .. in there.
// Since that could allow leaving sandbox.
throw new InvalidOperationException("This branch should never be reached.");
}
This causes the console completion for any command like exec /Test/B/.../ (three instead of 2 .) to throw exceptions.
I know on some versions of windows, apparently 3+ dots could be used to go back multiple folders, so it makes sense to filter that, but then that should also be handled by path.Clean(), so that it doesn't just raise an exception. Also, even if that gets filtered, currently things like /A/..B/C will still error, so the check in GetFullPath() needs updating anyways.