widelands-dev team mailing list archive

[SirVer <724344@xxxxxxxxxxxxxxxxxx>]

how should we handle this? Should we issue a build 15 security update?
build 15.1? I am against this, as builds are 'beta' by definition.

I suggest informing our user base and push the update in build 16. This
should also speed up adaption of build 16, nor?

-- 
You received this bug notification because you are a member of Widelands
Developers, which is a direct subscriber.
https://bugs.launchpad.net/bugs/724344

Title:
  Security issue in sending files in network game

Status in Widelands:
  Fix Committed

Bug description:
  Network games have capability to send savegames and maps over network.
  Receiving player first checks if the file exists, and if it exists,
  existing file is renamed before new file is received. Handling of the
  received file is not secure as FileSystem classes support using ".."
  in path to go out of filesystem root. For example sending a file name
  like "../.bashrc" allows some nasty things to happen.

  To fix this issue either FileSystem code should enforce that file
  accesses stay within created file system's root. Alternatively paths
  coming from network should be validated and  "..",  "~" and "/"
  accesses should be filtered out. Perhaps it's wise to implement both.