jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-05 17:43:23 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

[Client/Server] Keep non-deck files out of the deck storage (#7352)

Browse source 
The local deck and replay browsers list every file in the folder, so a
stray file (e.g. a PNG screenshot of a deck) can be parsed as a garbage
plaintext deck, opened in the editor, and uploaded. The server also
accepts oversized deck payloads with only silent truncation.

Hide files that are not in a supported deck/replay format in the two
QFileSystemModel views (directories stay visible), skip them when opening,
reject them when uploading, and make the server reject deck uploads larger
than MAX_FILE_LENGTH instead of truncating them.

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
This commit is contained in:
BruebachL 2026-09-27 21:32:49 +02:00 • committed by GitHub
parent fa8220df3c
commit 2632f8a040
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
cockatrice/src/interface/widgets/tabs/tab_deck_storage.cpp
View file

@ -14,6 +14,7 @@
#include <QDateTime>
#include <QDebug>
#include <QDesktopServices>
#include <QDir>
#include <QFileSystemModel>
#include <QGroupBox>
#include <QHBoxLayout>
@ -49,6 +50,12 @@ namespace
// How long to wait after the last visibility change before reading back the
// Public/Private column, in milliseconds.
constexpr int VISIBILITY_REFRESH_DELAY = 500;
// Whether the file's name matches one of the deck formats Cockatrice can load.
bool isSupportedDeckFile(const QString &filePath)
{
return QDir::match(DeckLoader::ACCEPTED_FILE_EXTENSIONS, QFileInfo(filePath).fileName());
}
} // namespace
TabDeckStorage::TabDeckStorage(TabSupervisor *_tabSupervisor,
@ -58,6 +65,8 @@ TabDeckStorage::TabDeckStorage(TabSupervisor *_tabSupervisor,
{
localDirModel = new QFileSystemModel(this);
localDirModel->setRootPath(SettingsCache::instance().paths().getDeckPath());
localDirModel->setNameFilters(DeckLoader::ACCEPTED_FILE_EXTENSIONS);
localDirModel->setNameFilterDisables(false);
localDirModel->sort(0, Qt::AscendingOrder);
localDirView = new QTreeView;
@ -312,6 +321,10 @@ void TabDeckStorage::actOpenLocalDeck()
}
QString filePath = localDirModel->filePath(curLeft);
if (!isSupportedDeckFile(filePath)) {
continue;
}
std::optional<LoadedDeck> deckOpt = DeckLoader::loadFromFile(filePath, DeckFileFormat::Cockatrice, true);
if (!deckOpt) {
continue;
@ -376,6 +389,11 @@ void TabDeckStorage::actUpload()
void TabDeckStorage::uploadDeck(const QString &filePath, const QString &targetPath)
{
if (!isSupportedDeckFile(filePath)) {
QMessageBox::critical(this, tr("Error"), tr("Invalid deck file"));
return;
}
QFile deckFile(filePath);
QFileInfo deckFileInfo(deckFile);