apex/DimDoors
1
1
Fork 0
Code Issues 26 Pull Requests Actions Packages Projects Releases Wiki Activity

Added a filter for bad schematic names

Browse Source 
Added a regex filter for bad schematic names in
CommandEndDungeonCreatoin. Names can only be made of letters, numbers,
and underscores now. This should prevent any nasty tricks people might
try to affect the underlying file system.
This commit is contained in:
SenseiKiwi
2013-06-15 02:40:00 -04:00
parent b174c69e5b
commit a24cd87ddb
1 changed files with 23 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
StevenDimDoors/mod_pocketDim/commands/CommandEndDungeonCreation.java
View File

@@ -1,17 +1,18 @@
package StevenDimDoors.mod_pocketDim.commands;
import StevenDimDoors.mod_pocketDim.DDProperties;
import StevenDimDoors.mod_pocketDim.DungeonGenerator;
import StevenDimDoors.mod_pocketDim.mod_pocketDim;
import StevenDimDoors.mod_pocketDim.helpers.DungeonHelper;
import StevenDimDoors.mod_pocketDim.helpers.dimHelper;
import java.util.regex.Pattern;
import net.minecraft.command.CommandBase;
import net.minecraft.command.ICommandSender;
import net.minecraft.entity.player.EntityPlayer;
import StevenDimDoors.mod_pocketDim.DDProperties;
import StevenDimDoors.mod_pocketDim.DungeonGenerator;
import StevenDimDoors.mod_pocketDim.mod_pocketDim;
public class CommandEndDungeonCreation extends CommandBase
{
private static DDProperties properties = null;
private static Pattern nameFilter = Pattern.compile("[A-Za-z0-9_]+");
public CommandEndDungeonCreation()
{
@@ -26,10 +27,8 @@ public class CommandEndDungeonCreation extends CommandBase
@Override
public void processCommand(ICommandSender var1, String[] var2)
{
EntityPlayer player =this.getCommandSenderAsPlayer(var1);
EntityPlayer player = this.getCommandSenderAsPlayer(var1);
if(!mod_pocketDim.dungeonHelper.customDungeonStatus.containsKey(player.worldObj.provider.dimensionId))
{
@@ -58,6 +57,9 @@ public class CommandEndDungeonCreation extends CommandBase
player.sendChatToPlayer("Must name file");
}
else if(!player.worldObj.isRemote)
{
//Check that the dungeon name is valid to prevent directory traversal and other forms of abuse
if (nameFilter.matcher(var2[0]).matches())
{
DungeonGenerator newDungeon = mod_pocketDim.dungeonHelper.exportDungeon(player.worldObj, x, y, z, properties.CustomSchematicDirectory + "/" + var2[0] + ".schematic");
player.sendChatToPlayer("created dungeon schematic in " + properties.CustomSchematicDirectory +"/"+var2[0]+".schematic");
@@ -70,6 +72,11 @@ public class CommandEndDungeonCreation extends CommandBase
}
}
else
{
player.sendChatToPlayer("Invalid schematic name. Please use only letters, numbers, and underscores.");
}
}
// TODO Auto-generated method stub