From 9082a473488226501b8a50cf02e49f3d98828d61 Mon Sep 17 00:00:00 2001 From: Alibek Omarov Date: Sun, 17 May 2026 10:41:59 +0500 Subject: [PATCH] engine: validate paths before downloading --- engine/common/http/net_http_xash.c | 7 ++++++- engine/common/net_chan.c | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/engine/common/http/net_http_xash.c b/engine/common/http/net_http_xash.c index ba2f32f4..9c79973e 100644 --- a/engine/common/http/net_http_xash.c +++ b/engine/common/http/net_http_xash.c @@ -18,7 +18,6 @@ GNU General Public License for more details. #include "client.h" // ConnectionProgress #include "netchan.h" #include "xash3d_mathlib.h" -#include "ipv6text.h" #include "net_ws_private.h" #include "miniz.h" @@ -943,6 +942,12 @@ void HTTP_AddDownload( const char *path, int size, qboolean process, resource_t { httpfile_t *httpfile; + if( COM_CheckNastyPath( path )) + { + Con_Printf( S_ERROR "%s: refused to download %s, nasty path\n", __func__, path ); + return; + } + if( !http.first_server ) { Con_Printf( S_ERROR "no servers to download %s\n", path ); diff --git a/engine/common/net_chan.c b/engine/common/net_chan.c index 248d8acd..599cce5c 100644 --- a/engine/common/net_chan.c +++ b/engine/common/net_chan.c @@ -1233,7 +1233,7 @@ qboolean Netchan_CopyFileFragments( netchan_t *chan, sizebuf_t *msg ) Netchan_FlushIncoming( chan, FRAG_FILE_STREAM ); return false; } - else if( filename[0] != '!' && !COM_IsSafeFileToDownload( filename )) + else if( filename[0] != '!' && ( COM_CheckNastyPath( filename ) || !COM_IsSafeFileToDownload( filename ))) { Con_Printf( S_ERROR "file fragment received with bad path, ignoring\n" ); Netchan_FlushIncoming( chan, FRAG_FILE_STREAM );