search

spheredev / neosphere

A lightweight game engine and development platform using JavaScript for game coding, based on the original Sphere engine by Chad Austin but with a redesigned, modern API and brand-new command-line development tools.
http://www.spheredev.org/
Other
106 stars 15 forks source link

Fix `FS.relativePath` not working for absolute paths #284

Open fatcerberus opened 6 years ago

fatcerberus commented 6 years ago

There is currently a bug in FS.relativePath which prevents it from working as expected when both the input path and base path refer to the physical file system ("are absolute paths"). There is an overly broad short-circuit condition in game_relative_path: https://github.com/fatcerberus/minisphere/blob/add36a2baacab6f697ba30054484b3f84ed89ead/src/minisphere/game.c#L544-L546

If the input path is absolute, the function returns early without attempting to relativize the path at all. Because of this, when passed an absolute path as input, FS.relativePath will always return the input path verbatim, even if the paths share a common prefix.

This is not a high-priority fix as it only affects games using the relaxed or none sandboxing modes. full sandboxing (the default and recommended mode) doesn't allow use of absolute paths at all and is therefore unaffected by this bug.

fatcerberus commented 5 years ago

Sandboxing has been further strengthened for miniSphere 5.3 (relaxed and none modes are no longer honored in production at all) to shore up the security of the SPK format, so this issue has become even less important. It might not even be worth solving now, especially since FS.relativePath is only intended for display.

That said, I'll leave the issue open as it's tagged back burner. So if I get bored enough I might just fix it anyway. :o)