[vlc-commits] [Git][videolan/vlc][master] skins2: fix extraction path traversal

[François Cartegnie (@fcartegnie)]

François Cartegnie pushed to branch master at VideoLAN / VLC


Commits:
1a0442bd by François Cartegnie at 2026-09-05T07:19:30+02:00
skins2: fix extraction path traversal

refs #29929

- - - - -


1 changed file:

- modules/gui/skins2/src/theme_loader.cpp


Changes:

=====================================
modules/gui/skins2/src/theme_loader.cpp
=====================================
@@ -229,6 +229,43 @@ bool ThemeLoader::unarchive( const std::string& fileName, const std::string &tem
                 return false;
             }
 
+            /* avoid bypassing uri resolve with query */
+            if( strchr( child->psz_name, '?' ) || strchr( child->psz_name, '#' ) )
+                return false;
+
+#if defined( _WIN32 )
+            if( strchr( child->psz_name, '\\' ) )
+                return false;
+#endif
+
+            auto base = make_cstr_ptr( vlc_path2uri( tempPath.c_str(), "file" ) );
+            if( !base )
+                return false;
+
+            std::string base_uri = base.get();
+            if( base_uri.empty() || base_uri.back() != '/' )
+                base_uri += '/';
+
+            auto ref = make_cstr_ptr( vlc_uri_fixup( child->psz_name ) );
+            if( !ref )
+                return false;
+
+            auto resolved = make_cstr_ptr( vlc_uri_resolve( base_uri.c_str(), ref.get() ) );
+            if( !resolved )
+                return false;
+
+            if( std::string( resolved.get() ).compare( 0, base_uri.size(), base_uri ) != 0 )
+            {
+                msg_Err( getIntf(), "Invalid resolved path from archive: %s", resolved.get() );
+                return false;
+            }
+
+#if defined( _WIN32 )
+            if( strchr( child->psz_name, '\\' ) != nullptr )
+                return false;
+#endif
+            /* Use the path validated through the uri resolution */
+
             auto out_path = tempPath + "/" + child->psz_name;
 
             { /* create directory tree */



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/1a0442bdd96546013f17a0683dd280804036e0fe

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/1a0442bdd96546013f17a0683dd280804036e0fe
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help