From 541f86c116e86a967cb06d12572bd2e522a9156b Mon Sep 17 00:00:00 2001 From: rootdarkarchon Date: Mon, 23 Jan 2023 09:34:57 +0100 Subject: [PATCH] block anything from user data that is not allowed to be synced --- .../MareSynchronosServer/Hubs/MareHub.User.cs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/MareSynchronosServer/MareSynchronosServer/Hubs/MareHub.User.cs b/MareSynchronosServer/MareSynchronosServer/Hubs/MareHub.User.cs index e985009..76b8782 100644 --- a/MareSynchronosServer/MareSynchronosServer/Hubs/MareHub.User.cs +++ b/MareSynchronosServer/MareSynchronosServer/Hubs/MareHub.User.cs @@ -114,6 +114,8 @@ public partial class MareHub [GeneratedRegex(@"^([a-z0-9_ '+&,\.\-\{\}]+\/)+([a-z0-9_ '+&,\.\-\{\}]+\.[a-z]{3,4})$", RegexOptions.IgnoreCase | RegexOptions.Compiled | RegexOptions.ECMAScript)] private static partial Regex GamePathRegex(); + private static readonly string[] AllowedExtensionsForGamePaths = { ".mdl", ".tex", ".mtrl", ".tmb", ".pap", ".avfx", ".atex", ".sklb", ".eid", ".phyb", ".scd", ".skp", ".shpk" }; + [Authorize(Policy = "Identified")] public async Task UserPushData(CharacterCacheDto characterCache, List visibleCharacterIds) { @@ -124,8 +126,9 @@ public partial class MareHub List invalidFileSwapPaths = new(); foreach (var replacement in characterCache.FileReplacements.SelectMany(p => p.Value)) { - var invalidPaths = replacement.GamePaths.Where(p => !GamePathRegex().IsMatch(p)).ToArray(); - replacement.GamePaths = replacement.GamePaths.Where(p => GamePathRegex().IsMatch(p)).ToArray(); + var invalidPaths = replacement.GamePaths.Where(p => !GamePathRegex().IsMatch(p)).ToList(); + invalidPaths.AddRange(replacement.GamePaths.Where(p => !AllowedExtensionsForGamePaths.Any(e => p.EndsWith(p, StringComparison.OrdinalIgnoreCase)))); + replacement.GamePaths = replacement.GamePaths.Where(p => !invalidPaths.Contains(p, StringComparer.OrdinalIgnoreCase)).ToArray(); bool validGamePaths = replacement.GamePaths.Any(); bool validHash = string.IsNullOrEmpty(replacement.Hash) || HashRegex().IsMatch(replacement.Hash); bool validFileSwapPath = string.IsNullOrEmpty(replacement.FileSwapPath) || GamePathRegex().IsMatch(replacement.FileSwapPath);