search

dedmen / ArmaScriptCompiler

GNU General Public License v3.0
26 stars 12 forks source link

[Security] Full local path included in output #28

Closed jonpas closed 7 months ago

jonpas commented 1 year ago

This is a security issue and should be remedied.

Diff

jonpas commented 1 year ago

@PabstMirror @BrettMayson

dedmen commented 7 months ago

Not just security, this will also lead to incorrect in-game paths. Arma 3 base files have the same issue, resulting in /temp/bin/A3/Functions_F/Ambient/fn_ambientAnim.sqf instead of \A3\Functions_F\Ambient\fn_ambientAnim.sqf

dedmen commented 7 months ago

The problem is that the "root" what would often be a p-drive root. Is unknown. We can try finding it by looking for PBOPREFIX, which might solve most cases (doesn't solve our vanilla A3 case)

Instead of that, I'll add "rootPathMapping" config entry. They will map physical paths to virtual paths.

So in your case the root path might be "C:/Users/username/Appdata/Local/Temp/hemtt/DEV_CBA_A3/asc/source" -> "\x\cba\" Such that your file instead of /Users/username/Appdata/Local/Temp/hemtt/DEV_CBA_A3/asc/source/addons/common/fnc_test.sqf will be translated to \x\cba\addons/common/fnc_test.sqf

dedmen commented 7 months ago

Also important note on this, this changes how the outputPath is handled. result file is outputPath/virtualPath. Because the virtualPath was previously bugged, it would output to example P:/Users/username/Appdata/Local/Temp/hemtt/DEV_CBA_A3/asc/source/addons/common/fnc_test.sqfc But with the fix, it will now output to P:\x\cba\addons/common/fnc_test.sqf