Improperly sanitizied paths cause filesystem escape
Package
CraftOS-PC
(Windows)
Affected versions
< v2.8.3
Patched versions
v2.8.3
CraftOS-PC
(macOS)
< v2.8.3
v.2.8.3
CraftOS-PC
(Launchpad PPA ~jackmacwindows)
< v2.8.3
v2.8.3
CraftOS-PC
(Arch Linux AUR)
< v2.8.3
v2.8.3
CraftOS-PC
(iOS App Store)
< v2.8.3
v2.8.3
CraftOS-PC
(Google Play Store)
< v2.8.3
v2.8.3
Describe the bug
You can escape the computer folder and access files anywhere without permission or notice,
by obfuscating
..
s to bypass the internal check preventing parent directory traversal.To Reproduce
Link: Microsoft - Naming Conventions
You can mix the following reserved characters
< > : " | ?
(excludes/ \ *
) into a..
to bypass the check, e.g.<..>
or..|
.Afterwards the reserved characters appear to be silently dropped by the filesystem.
Steps to reproduce the behavior:
cd ..|
followed byls
multiple times.Expected behavior
For the reserved characters to be filtered out by the
fs
api before the internal check against..
s, preventing parent directory traversal.Screenshots
Environment