Skip to content

tweak(network): Add file extension validation to network map transfer #1818

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 11, 2025
Merged

tweak(network): Add file extension validation to network map transfer #1818

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
28c81c1
fix(security): add file extension validation for map transfer
bobtista Nov 6, 2025
5648a6d
refactor(security): address code review feedback on extension validation
bobtista Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions Core/GameEngine/Source/GameNetwork/ConnectionManager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,36 @@
#include "GameClient/DisconnectMenu.h"
#include "GameClient/InGameUI.h"

static Bool hasValidTransferFileExtension(const AsciiString& filePath)
{
static const char* const validExtensions[] = {
"map",
"ini",
"str",
"wak",
"tga",
"txt"
};

const char* fileExt = strrchr(filePath.str(), '.');

if (fileExt == NULL || fileExt[1] == '\0')
{
return false;
}

fileExt++;

for (Int i = 0; i < ARRAY_SIZE(validExtensions); ++i)
{
if (stricmp(fileExt, validExtensions[i]) == 0)
{
return true;
}
}

return false;
}

/**
* Le destructor.
Expand Down Expand Up @@ -665,6 +695,13 @@ void ConnectionManager::processFile(NetFileCommandMsg *msg)
return;
}

// TheSuperHackers @security bobtista 06/11/2025 Validate file extension to prevent arbitrary file types
if (!hasValidTransferFileExtension(realFileName))
{
DEBUG_LOG(("File '%s' has invalid extension for transfer operations.", realFileName.str()));
return;
}

if (TheFileSystem->doesFileExist(realFileName.str()))
{
DEBUG_LOG(("File exists already!"));
Expand Down
Loading