pegasus/weechat
1
0
Fork 0
mirror of https://github.com/weechat/weechat.git synced 2026-06-12 14:14:48 +02:00
Code Activity

xfer: replace directory separator in remote nick by underscore in download filename

Browse Source
This commit is contained in:
aizu-m
2026-06-02 12:31:10 +05:30
committed by Sébastien Helleu
parent b802681230
commit 23291acb7b
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+1
View File
@@ -28,6 +28,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
- relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion - relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion
- relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc)) - relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
- api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc)) - api, relay: fix timing attack on TOTP validation ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc))
- xfer: replace directory separator in remote nick by underscore in download filename to prevent writing the file outside the download directory
## Version 4.9.1 (2026-05-31) ## Version 4.9.1 (2026-05-31)
src/plugins/xfer/xfer-file.c
+11 -3
View File
@@ -251,7 +251,7 @@ xfer_file_find_suffix (struct t_xfer *xfer)
void void
xfer_file_find_filename (struct t_xfer *xfer) xfer_file_find_filename (struct t_xfer *xfer)
{ {
char *dir_separator, *path; char *dir_separator, *path, *nick;
struct t_hashtable *options; struct t_hashtable *options;
if (!XFER_IS_FILE(xfer->type)) if (!XFER_IS_FILE(xfer->type))
@@ -287,12 +287,20 @@ xfer_file_find_filename (struct t_xfer *xfer)
{ {
strcat (xfer->local_filename, dir_separator); strcat (xfer->local_filename, dir_separator);
} }
free (dir_separator);
if (weechat_config_boolean (xfer_config_file_use_nick_in_filename)) if (weechat_config_boolean (xfer_config_file_use_nick_in_filename))
{ {
strcat (xfer->local_filename, xfer->remote_nick); /*
* the remote nick comes from the server and can contain a directory
* separator: replace it so the nick cannot make the file be written
* outside the download directory
*/
nick = (dir_separator) ?
weechat_string_replace (xfer->remote_nick, dir_separator, "_") : NULL;
strcat (xfer->local_filename, (nick) ? nick : xfer->remote_nick);
free (nick);
strcat (xfer->local_filename, "."); strcat (xfer->local_filename, ".");
} }
free (dir_separator);
strcat (xfer->local_filename, xfer->filename); strcat (xfer->local_filename, xfer->filename);
free (path); free (path);