kindred/create
1
1
Fork 0
Code Issues 53 Pull Requests Actions Packages Projects 9 Releases 2 Wiki Activity

fix further file names vulnerabilities in core system and Image module

Browse Source
This commit is contained in:
wmayer
2019-10-02 15:07:13 +02:00
parent bed78b0b7b
commit d2be4f115d
3 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/App/Application.cpp
View File

@@ -2057,6 +2057,8 @@ std::list<std::string> Application::processFiles(const std::list<std::string>& f
std::vector<std::string> mods = App::GetApplication().getImportModules(ext.c_str());
if (!mods.empty()) {
std::string escapedstr = Base::Tools::escapedUnicodeFromUtf8(file.filePath().c_str());
escapedstr = Base::Tools::escapeEncodeFilename(escapedstr);
Base::Interpreter().loadModule(mods.front().c_str());
Base::Interpreter().runStringArg("import %s",mods.front().c_str());
Base::Interpreter().runStringArg("%s.open(u\"%s\")",mods.front().c_str(),
@@ -2107,6 +2109,8 @@ void Application::processCmdLineFiles(void)
std::map<std::string,std::string>::const_iterator it = cfg.find("SaveFile");
if (it != cfg.end()) {
std::string output = it->second;
output = Base::Tools::escapeEncodeFilename(output);
Base::FileInfo fi(output);
std::string ext = fi.extension();
try {
@@ -2452,7 +2456,7 @@ void Application::ParseOptions(int ac, char ** av)
if (vm.count("help")) {
std::stringstream str;
str << mConfig["ExeName"] << endl << endl;
str << "For a detailed description see https://www.freecadweb.org/wiki/Start_up_and_Configuration" << endl<<endl;
str << "For a detailed description see https://www.freecadweb.org/wiki/Start_up_and_Configuration" << endl<<endl;
str << "Usage: " << mConfig["ExeName"] << " [options] File1 File2 ..." << endl << endl;
str << visible << endl;
throw Base::ProgramInformation(str.str());