search

EasyRPG / Player

RPG Maker 2000/2003 and EasyRPG games interpreter
https://easyrpg.org/player/
GNU General Public License v3.0
989 stars 185 forks source link

StringVariable's ToFile - Relax File extension and path #3212

Closed jetrotal closed 4 months ago

jetrotal commented 5 months ago

When saving a file, maniacs forces the File in Text/ folder with .txt extension. Through this PR, if '*' is at the end of filename, the file extension is relaxed.

carstene1ns commented 5 months ago

Does this open an issue with path traversal: ../../../some/file?

jetrotal commented 5 months ago

I guess not, the default behavior allows leaving the /text/file.txt by using ../charset/file.txt as a file name.

my code, simply moves the text file from /text/ to the root of the game whenver the filename ends with *

Ghabry commented 5 months ago

In an ideal world where Maniac Patch and TPC are open source and not obfuscated I would suggest to add a new flag to indicate "absolute path". End of rant

This is a bit opinionated but I do not like the *. The typical convention for an absolute path is to prefix it with /. You should be even able to forward such a path directly to OpenOutputStream without removing the slash manually.

Can you add a comment that this is an EasyRPG Extension?

(Also please remove trivial comments like // Remove the last character. Makes the code look less ChatGPT-generated.)