jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-28 00:42:19 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

[Client/Server] Keep non-deck files out of the deck storage (#7352)

Browse source 
The local deck and replay browsers list every file in the folder, so a
stray file (e.g. a PNG screenshot of a deck) can be parsed as a garbage
plaintext deck, opened in the editor, and uploaded. The server also
accepts oversized deck payloads with only silent truncation.

Hide files that are not in a supported deck/replay format in the two
QFileSystemModel views (directories stay visible), skip them when opening,
reject them when uploading, and make the server reject deck uploads larger
than MAX_FILE_LENGTH instead of truncating them.

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
This commit is contained in:
BruebachL 2026-09-27 21:32:49 +02:00 • committed by GitHub
parent fa8220df3c
commit 2632f8a040
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
servatrice/src/serversocketinterface.cpp
View file

@ -982,6 +982,10 @@ Response::ResponseCode AbstractServerSocketInterface::cmdDeckUpload(const Comman
return Response::RespInvalidData;
}
if (cmd.deck_list().size() > static_cast<std::string::size_type>(MAX_FILE_LENGTH)) {
return Response::RespInvalidData;
}
sqlInterface->checkSql();
QString deckStr = fileFromStdString(cmd.deck_list());