From 003c3e0af1714dd577084ad4a27ca1edec03c4bb Mon Sep 17 00:00:00 2001 From: Adam Honse Date: Fri, 31 Jul 2026 19:01:25 -0500 Subject: [PATCH] Sanitize filenames from clients in NetworkServer --- NetworkServer.cpp | 23 ++++++++++++----------- StringUtils.cpp | 28 ++++++++++++++++++++++++++++ StringUtils.h | 1 + 3 files changed, 41 insertions(+), 11 deletions(-) diff --git a/NetworkServer.cpp b/NetworkServer.cpp index d0839e8d6..c7e488d31 100644 --- a/NetworkServer.cpp +++ b/NetworkServer.cpp @@ -8,6 +8,7 @@ #include "NetworkServer.h" #include "LogManager.h" +#include "StringUtils.h" #include #ifndef WIN32 @@ -266,7 +267,7 @@ void NetworkServer::StartServer() for(res = result; res && socket_count < MAXSOCK; res = res->ai_next) { server_sock[socket_count] = socket(res->ai_family, res->ai_socktype, res->ai_protocol); - + if(server_sock[socket_count] == INVALID_SOCKET) { printf("Error: network socket could not be created\n"); @@ -320,7 +321,7 @@ void NetworkServer::StartServer() freeaddrinfo(result); server_online = true; - + /*-------------------------------------------------*\ | Start the connection thread | \*-------------------------------------------------*/ @@ -430,7 +431,7 @@ void NetworkServer::ConnectionThreadFunction(int socket_idx) socklen_t len; len = sizeof(tmp_addr); getpeername(client_info->client_sock, (struct sockaddr*)&tmp_addr, &len); - + if(tmp_addr.ss_family == AF_INET) { struct sockaddr_in *s_4 = (struct sockaddr_in *)&tmp_addr; @@ -780,7 +781,7 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info) if(profile_manager) { - profile_manager->SaveProfile(data); + profile_manager->SaveProfile(StringUtils::make_filename(data)); } break; @@ -793,7 +794,7 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info) if(profile_manager) { - profile_manager->LoadProfile(data); + profile_manager->LoadProfile(StringUtils::make_filename(data)); } for(RGBController* controller : controllers) @@ -811,7 +812,7 @@ void NetworkServer::ListenThreadFunction(NetworkClientInfo * client_info) if(profile_manager) { - profile_manager->DeleteProfile(data); + profile_manager->DeleteProfile(StringUtils::make_filename(data)); } break; @@ -1028,7 +1029,7 @@ void NetworkServer::SendReply_PluginList(SOCKET client_sock) { unsigned int data_size = 0; unsigned int data_ptr = 0; - + /*---------------------------------------------------------*\ | Calculate data size | \*---------------------------------------------------------*/ @@ -1045,12 +1046,12 @@ void NetworkServer::SendReply_PluginList(SOCKET client_sock) data_size += strlen(plugins[i].version.c_str()) + 1; data_size += sizeof(unsigned int) * 2; } - + /*---------------------------------------------------------*\ | Create data buffer | \*---------------------------------------------------------*/ unsigned char *data_buf = new unsigned char[data_size]; - + /*---------------------------------------------------------*\ | Copy in data size | \*---------------------------------------------------------*/ @@ -1103,14 +1104,14 @@ void NetworkServer::SendReply_PluginList(SOCKET client_sock) \*---------------------------------------------------------*/ memcpy(&data_buf[data_ptr], &i, sizeof(unsigned int)); data_ptr += sizeof(unsigned int); - + /*---------------------------------------------------------*\ | Copy in plugin sdk version (data) | \*---------------------------------------------------------*/ memcpy(&data_buf[data_ptr], &plugins[i].protocol_version, sizeof(int)); data_ptr += sizeof(int); } - + NetPacketHeader reply_hdr; unsigned int reply_size; diff --git a/StringUtils.cpp b/StringUtils.cpp index 614679c10..5028621d1 100644 --- a/StringUtils.cpp +++ b/StringUtils.cpp @@ -38,3 +38,31 @@ const char* StringUtils::wchar_to_char(const wchar_t* pwchar) return filePathC; } + +std::string StringUtils::make_filename(std::string input) +{ + /*-----------------------------------------------------*\ + | Replace : characters with - characters | + \*-----------------------------------------------------*/ + input = std::regex_replace(input, std::regex(":"), "-"); + + /*-----------------------------------------------------*\ + | Remove all other characters | + \*-----------------------------------------------------*/ + input = std::regex_replace(input, std::regex("[#%&\\{\\}\\\\<>\\*\\?/!`';@+|=]"), ""); + + /*-----------------------------------------------------*\ + | Remove leading . characters | + \*-----------------------------------------------------*/ + input = std::regex_replace(input, std::regex("^\\.+"), ""); + + /*-----------------------------------------------------*\ + | Remove control characters | + \*-----------------------------------------------------*/ + input = std::regex_replace(input, std::regex("[\\x00-\\x1F\\x7F]"), ""); + + /*-----------------------------------------------------*\ + | Return complete string | + \*-----------------------------------------------------*/ + return(input); +} diff --git a/StringUtils.h b/StringUtils.h index 7b52f46bd..a5918384b 100644 --- a/StringUtils.h +++ b/StringUtils.h @@ -5,6 +5,7 @@ class StringUtils { public: static const char* wchar_to_char(const wchar_t* pwchar); + static std::string make_filename(std::string input); }; #endif // STRING_UTILS_H