jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-11-06 01:53:25 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

[Client/Server] Keep non-deck files out of the deck storage (#7352)

Browse source 
The local deck and replay browsers list every file in the folder, so a
stray file (e.g. a PNG screenshot of a deck) can be parsed as a garbage
plaintext deck, opened in the editor, and uploaded. The server also
accepts oversized deck payloads with only silent truncation.

Hide files that are not in a supported deck/replay format in the two
QFileSystemModel views (directories stay visible), skip them when opening,
reject them when uploading, and make the server reject deck uploads larger
than MAX_FILE_LENGTH instead of truncating them.

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
This commit is contained in:
BruebachL 2026-09-27 21:32:49 +02:00 • committed by GitHub
parent fa8220df3c
commit 2632f8a040
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
cockatrice/src/interface/widgets/tabs/tab_replays.cpp
View file

@ -9,6 +9,7 @@
#include <QApplication>
#include <QClipboard>
#include <QDesktopServices>
#include <QDir>
#include <QFileSystemModel>
#include <QGroupBox>
#include <QHBoxLayout>
@ -34,6 +35,12 @@
inline Q_LOGGING_CATEGORY(TabReplaysLog, "replays_tab");
namespace
{
// File name filters for the local replay files Cockatrice can load.
const QStringList REPLAY_FILE_NAME_FILTERS = {"*.cor"};
} // namespace
TabReplays::TabReplays(TabSupervisor *_tabSupervisor, AbstractClient *_client, const ServerInfo_User *currentUserInfo)
: Tab(_tabSupervisor), client(_client)
{
@ -62,6 +69,8 @@ QGroupBox *TabReplays::createLeftLayout()
{
localDirModel = new QFileSystemModel(this);
localDirModel->setRootPath(SettingsCache::instance().paths().getReplaysPath());
localDirModel->setNameFilters(REPLAY_FILE_NAME_FILTERS);
localDirModel->setNameFilterDisables(false);
localDirModel->sort(0, Qt::AscendingOrder);
localDirView = new QTreeView;
@ -263,6 +272,10 @@ void TabReplays::actOpenLocalReplay()
}
QString filePath = localDirModel->filePath(curLeft);
if (!QDir::match(REPLAY_FILE_NAME_FILTERS, QFileInfo(filePath).fileName())) {
continue;
}
QFile f(filePath);
if (!f.open(QIODevice::ReadOnly)) {
continue;