From 3c5c7fbc80d50aa160eb4147015af33f00fa2bb3 Mon Sep 17 00:00:00 2001 From: goat <16760685+goaaats@users.noreply.github.com> Date: Sun, 22 Aug 2021 17:26:16 +0200 Subject: [PATCH] fix: folders in plugin zips, throw if DLL can't be overwritten --- Dalamud/Plugin/Internal/PluginManager.cs | 28 ++++++++++++++++++------ 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/Dalamud/Plugin/Internal/PluginManager.cs b/Dalamud/Plugin/Internal/PluginManager.cs index 204f025fb..5b386de1a 100644 --- a/Dalamud/Plugin/Internal/PluginManager.cs +++ b/Dalamud/Plugin/Internal/PluginManager.cs @@ -414,31 +414,45 @@ namespace Dalamud.Plugin.Internal Log.Debug($"Extracting to {outputDir}"); // This throws an error, even with overwrite=false // ZipFile.ExtractToDirectory(tempZip.FullName, outputDir.FullName, false); - using (var archive = new ZipArchive(response.Content.ReadAsStream())) + using (var archive = new ZipArchive(await response.Content.ReadAsStreamAsync())) { foreach (var zipFile in archive.Entries) { - var completeFileName = Path.GetFullPath(Path.Combine(outputDir.FullName, zipFile.FullName)); + var outputFile = new FileInfo(Path.GetFullPath(Path.Combine(outputDir.FullName, zipFile.FullName))); - if (!completeFileName.StartsWith(outputDir.FullName, StringComparison.OrdinalIgnoreCase)) + if (!outputFile.FullName.StartsWith(outputDir.FullName, StringComparison.OrdinalIgnoreCase)) { throw new IOException("Trying to extract file outside of destination directory. See this link for more info: https://snyk.io/research/zip-slip-vulnerability"); } - if (zipFile.Name == string.Empty) + if (outputFile.Directory == null) { + throw new IOException("Output directory invalid."); + } + + if (zipFile.Name.IsNullOrEmpty()) + { + Log.Error("zipFile.Name is null or empty"); // Assuming Empty for Directory - Directory.CreateDirectory(Path.GetDirectoryName(completeFileName)); + Directory.CreateDirectory(outputFile.Directory.FullName); continue; } + // Ensure directory is created + Directory.CreateDirectory(outputFile.Directory.FullName); + try { - zipFile.ExtractToFile(completeFileName, true); + zipFile.ExtractToFile(outputFile.FullName, true); } catch (Exception ex) { - Log.Information($"Could not overwrite {zipFile.Name}: {ex.Message}"); + if (outputFile.Extension.EndsWith("dll")) + { + throw new IOException($"Could not overwrite {zipFile.Name}: {ex.Message}"); + } + + Log.Error($"Could not overwrite {zipFile.Name}: {ex.Message}"); } } }