Added path sanitization and fix for rampageX/firmware-mod-kit

fkie-cad / fact_extractor

Standalone Utility for FACT-like extraction

GNU General Public License v3.0

80 stars 31 forks source link

Added path sanitization and fix for rampageX/firmware-mod-kit #95

Closed Caesurus closed 1 year ago

Caesurus commented 1 year ago

Changes in rampageX/firmware-mod-kit this PR removed the configure file, which is no longer needed. But it broke the build for fact.

Additionally we've added a general function to sanitize path names.

Caesurus commented 1 year ago

I'll go ahead and fix the conflict. The file_name_sanitize is used in a proprietary file format unpacker that I can't share, but it had a directory traversal vulnerability because the file path in the archive was used 'as-is'. Having the functionality in a common location seemed more appropriate since more unpackers can make use of it.